22 matches found
EUVD-2026-114112
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents,...
CVE-2026-119707: SonicJs-Org sonicjs: SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write…
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents,...
DotCMS Arbitrary File Upload RCE (CVE-2022-26352)
Exploits CVE-2022-26352 path traversal in multipart filenames on POST /api/content/ to write a JSP shell under webapps/ROOT, then triggers a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """DotCMS arbitrary file upload RCE CVE-2022-26352 — JSP upload + reverse CMD.""" from future...
CVE-2026-46365
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/tagId endpoint that allows any authenticated user to delete tags. Any logged-in user, including regular frontend users, can delete arbitrary tags by sending a DELETE request with a valid...
PT-2026-42599
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7cx3-2qx2-3g6w. This link is maintained to preserve external references. Original Description phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/tagId...
CVE-2026-46365: Missing Authorization
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/tagId endpoint that allows any authenticated user to delete tags. Any logged-in user, including regular frontend users, can delete arbitrary tags by sending a DELETE request with a valid...
PT-2026-41478
Summary The TagController::delete endpoint at DELETE /admin/api/content/tags/tagId only verifies that the user is logged in userIsAuthenticated, but does not check any permission. Any authenticated user — including regular non-admin frontend users — can delete any tag by ID. This contrasts with...
GHSA-7X5C-VFHJ-9628 Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
Impact This is a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected. Who is impacted: - Any deployment where the /api/content/aggregate/model endpoint is publicly accessible...
CVE-2019-16890
Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments...
CVE-2025-32951
CVE-2025-32951 affects io.jmix.rest:jmix-rest via the /files endpoint, enabling XSS when an attacker manipulates a file-path/name input so the Content-Type becomes text/html for names ending with .html. Impact is cross-site scripting in browsers when a malicious file is uploaded beforehand. Affec...
Stored XSS vulnerability in anchore-container-scanner
anchore-container-scanner 1.0.24 and earlier does not escape content provided by the Anchore engine API. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control API responses by Anchore engine. anchore-container-scanner 1.0.25 escapes content...
CVE-2020-19007
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser...
CVE-2020-19007: Improper Neutralization of Input During Web Page Generation
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser...
PT-2020-15154
Name of the Vulnerable Software and Affected Versions Halo blog version 1.2.0 Description The issue allows attackers to submit comments on blog posts via the "/api/content/posts/comments" API endpoint. The JavaScript code supplied by the attacker will then execute in the victim user's browser...
CVE-2019-16890
Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments...
CVE-2019-16890: Improper Neutralization of Input During Web Page Generation
Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments...
PT-2019-14847
Name of the Vulnerable Software and Affected Versions Halo version 1.1.0 Description The issue allows for XSS via a crafted authorUrl in JSON data to the "api/content/posts/comments" API endpoint. Recommendations For Halo version 1.1.0, avoid using the authorUrl variable in the...
CVE-2018-16622: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...
PT-2018-13652
Name of the Vulnerable Software and Affected Versions DoraCMS version 2.0.3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities are located in the /api/content/addOne endpoint and allow remote attackers to inject arbitrary web script or HTML. Th...