REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

Summary The mediapool sync page sync.php renders filenames from the /media filesystem directory directly into HTML without applying rexescape i.e., htmlspecialchars. Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any...

CVE-2024-37081

CVE-2024-37081: VMware vCenter Server における複数のローカル権限昇格の脆弱性 vCenter Server には、sudo の設定ミスにより複数のローカル権限昇格の脆弱性が存在します。非管理者権限を持つ認証済みローカルユーザーがこれらの問題を悪用し、vCenter Server Appliance 上で root に権限を昇格させる可能性があります。 ベンダー開示情報: この脆弱性に関するベンダーの開示情報はこちらで確認できます。 要件: この脆弱性には以下が必要です: 設定ミスのある sudo...

CVE-2026-86678 Broken Authentication vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...

CVE-2026-86678

ZohoCorp ManageEngine Applications Manager versions 182000 and below are vulnerable to a broken authentication flaw. This vulnerability allows a low-privileged user to obtain an administrator’s API key , which can then be leveraged to perform administrator-level actions . Exploitation details and...

CVE-2026-86677

ZohoCorp ManageEngine Applications Manager (versions 182000 and below) is vulnerable to a Broken Authentication issue caused by the improper neutralization of special elements in an SQL command . This flaw allows a low-privileged user to execute unauthorized SQL commands, which could lead to admi...

EUVD-2026-85295

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...

CVE-2026-86679 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

EUVD-2026-85293

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

CVE-2026-86679

ZohoCorp ManageEngine Applications Manager (versions 182000 and below ) is susceptible to a permissions validation issue . This vulnerability allows a low-privileged user to delete service monitors that are outside of their assigned scope. The documents do not provide specific details regarding t...

EUVD-2026-85291

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86683 Broken Authentication Vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation のメモリAPIにおける所有権チェックの欠如により、ユーザー間をまたいだメモリの読み取りと削除が可能でした。 主なアドバイザリ: GHSA-qv97-83w4-ff86 研究者クレジット: @chaitanyagarware 早見表 フィールド| 値 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project| vmDeshpande/ai-agent-automation Package| backend Ecosystem| npm 深刻度| 高 CVS...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA（LM Configuration Wizard）認証バイパス（シンプルなJavaユーザーと管理者Javaユーザーの作成） SAP NetWeaverは、SAPの統合テクノロジープラットフォームであり、SAP Business Suite以降のすべてのSAPアプリケーションの技術基盤です。SAP NetWeaverは、サービス指向のアプリケーションおよび統合プラットフォームであり、SAPアプリケーションの開発・実行環境を提供します。また、カスタム開発や他のアプリケーション・システムとの統合にも使用できます。SAP...

EUVD-2026-85261

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

EUVD-2026-85260

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-84791 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-12793

CVE-2026-12793 — JetFormBuilder 未認証の権限昇格 WordPress プラグイン JetFormBuilder — Dynamic Blocks Form Builder Crocoblock における CVE-2026-12793 の概念実証スキャナーおよびエクスプロイト。 | ---|--- CVE| CVE-2026-12793 プラグイン| jetformbuilder 影響を受けるバージョン| ≤ 3.6.2 修正バージョン| 3.6.2.1+ CVSS| 9.8 Critical 認証| 未認証 CWE| CWE-269 — 不適切な権限管理...

CVE-2025-57392

CVE-2025-57392 🔒 セキュリティ脆弱性レポート 製品: BenimPOS Desktop V3.0 脆弱性タイプ: 安全でないファイル権限 影響を受けるコンポーネント: BenimPOS.exe、unins000.exe、System.Data.SQLite.dll 脆弱性クラス: CWE-276: 不適切なデフォルト権限 PoC作成者: Fatih Bülbül テスト環境: Windows 11 x64 – ローカル管理者 + 標準ユーザー 🛠️ 1. 脆弱性の検出...

CVE-2026-96443

A vulnerability exists in Apache Doris due to insufficient validation of the JDBC driver URL . This flaw allows a privileged user to achieve remote code execution (RCE) on the FE (Front-End) . While the CVSS score indicates a medium severity, the technical impact is described as partial. No speci...

CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...