CVE-2026-109327

The Admidio application (versions 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the system/redirect.php component. The root cause is an incomplete fix for CVE-2021-43810, allowing unauthenticated attackers to inject JavaScript via ...

CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-109293

Open WebUI versions 0.11.0 through 0.11.3 are vulnerable to an information disclosure flaw via the Tool Export Endpoint . Authenticated non-admin users with tool export permissions can use a GET request to /api/v1/tools/export to retrieve the full Python source code of read-only shared tools. Thi...

EUVD-2026-97595

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of...

CVE-2026-109287

Open WebUI versions 0.9.6 before 0.11.4 are vulnerable to an information disclosure flaw due to an authorization oversight. The application fails to verify that a supplied directory_id belongs to the requested knowledge base when accessing GET /api/v1/knowledge/{id}/files . An attacker with read ...

EUVD-2026-97589

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2018-6574

CVE-2018-6574 Remote command execution in Golang go get command. CVE-2018-6574 this vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system by installing a malicious library, this vulnerability was fixed in Go 1.8.7, 1.9.4 and 1.10rc2. Golang will bui...

CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

go-get-RCE

go-get-RCE This is the exploit of CVE-2018-6574: go get RCE This vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system installing their malicious library. This is a good example of a vulnerability that can be exploited using typosquatting to gain co...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC Code for veracode blog To demonstrate the Code Execution, 1. Build the project using maven 2. Execute python3 -m http.server 8080 to run the http server 3. Run exploit.java. You should observe a HTTP GET request on the server 4. To demonstrate how SnakeYAML 2.0 prevent...

CVE-2026-109184

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to vie...

CVE-2026-109179

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions...

CVE-2026-109184

The software jshERP through version 3.6 is vulnerable to an improper authorization (CWE-862) flaw. Low-privilege authenticated users can bypass data scope restrictions to read any settlement account ledger by providing an arbitrary accountId via the GET /account/findAccountInOutList endpoint. Thi...

EUVD-2026-97388

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to vie...

EUVD-2026-97386

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109182

jshERP versions through 3.6 are affected by an incorrect authorization vulnerability (CWE-863) in the GET /supplier/exportExcel endpoint. While the /supplier/list endpoint correctly enforces role data scope restrictions, this specific export function fails to do so. This allows authenticated user...

CVE-2026-109181

The jshERP software, versions through 3.6 , is affected by an authorization bypass vulnerability. An authenticated user restricted to personal or department data can access other users' bills by including a purchaseStatus=0 value in the search JSON on the GET /depotHead/list endpoint. This input ...

EUVD-2026-97385

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing...

CVE-2026-109181 jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing...