CVE-2026-93860

A flaw was found in OpenStack Mistral. The maintenance API endpoint is missing an authorization check, allowing any authenticated user to activate global maintenance mode on the Mistral service. When an attacker triggers maintenance mode, all write operations workflow execution creation,...

CVE-2020-26733

CVE-2020-26733 SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 Cross Site Scripting XSS Vulnerability Description Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their...

CVE-2022-48311

CVE-2022-48311 HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B HTTP configuration page Cross Site Scripting XSS Vulnerability Description Cross Site Scripting XSS in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number...

Security Bulletin: IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI [CVE-2026-93886]

Summary IBM i is vulnerable to allowing a remote user to execute script code due to improper validation CVE-2026-93886 in HTTP Server Administration Graphical User Interface GUI as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-93886 DESCRIPTION: IBM i could...

Gitea-Forgejo-CVE-2025-68937

Arbitrary template expansion vulnerability in Gitea and Forgejo This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Summary While checking Forgejo's and Gitea's source code to better understand how templating is performed, I discovered a vulnerability...

CVE-2020-29607-Pluck-CMS-4.7.13-Authenticated-File-Upload-RCE-PoC

CVE-2020-29607 — Pluck CMS Authenticated remote code execution in Pluck CMS before 4.7.13. The admin file manager admin.php?action=files does not validate file extensions, allowing upload of .phar files which Apache executes as PHP. Uploading a webshell through this endpoint results in RCE as the...

CVE-2025-10307

Exploit: Arbitrary File Deletion via Backuply tarfile path traversal Browser Console PoC authenticated admin async = const page = $location.origin/wordpress/wp-admin/admin.php?page=backuply; // 1 Extract a valid nonce from the Backuply page const html = await fetchpage, credentials: 'same-origin'...

CVE-2026-32238_RemoteCodeExecutionOpenEMR8.0.0

CVE-2026-32238 - Remote Code Execution in OpenEMR Weakness CWE-78 : Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize...

CVE-2026-107799

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

CVE-2026-107793

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's...

CVE-2026-107798

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...

CVE-2026-105275

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files...

CVE-2026-107801 Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share i...

CVE-2026-107799 Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

CVE-2026-107797

The software Jivejdon (through version 5.0 ) is vulnerable to a reflected cross-site scripting (XSS) flaw in the application/message/postThread.jsp component. The root cause is the failure to properly encode the to and tag parameters, which allows an attacker to break out of unencoded inline Java...

CVE-2026-107797 Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...

CVE-2026-93858

A flaw was found in OpenStack Mistral. The std.sshproxied built-in action accepts a user-supplied proxycommand parameter that is passed without validation to a system subprocess call on the Mistral executor host. An authenticated attacker can craft a malicious workflow that supplies an arbitrary...

CVE-2026-97147

A flaw was found in OpenStack Mistral. Due to a missing authorization check in the action definition and environment update paths, an authenticated user can modify or overwrite another project's publicly-scoped action definitions and environments. An attacker with a valid account in any project c...

CVE-2026-84247

IBM Guardium Data Protection version 12.2 is vulnerable to a path traversal vulnerability (CWE-22), which could allow a remote authenticated attacker to cause a denial of service . IBM has addressed this vulnerability in a system update. To remediate, customers are encouraged to update their syst...

CVE-2026-104628

Satel Netco Design versions prior to v2.1.7 are vulnerable to an inefficient regular expression complexity vulnerability (CWE-1333). An authenticated user with Viewer privileges can submit specially crafted search input that triggers excessive processing. This flaw can lead to a degradation of th...