CVE-2026-105798 SimpleChat: Stored XSS via group document filename in inline onclick handler

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...

CVE-2026-105798 SimpleChat: Stored XSS via group document filename in inline onclick handler

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...

CVE-2026-105798 SimpleChat: Stored XSS via group document filename in inline onclick handler

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...

CVE-2026-105798

Prior to version 0.261.029 , the SimpleChat application is vulnerable to Stored XSS via group document filenames. The POST /api/group_documents/upload endpoint allows an authenticated Owner, Admin, or DocumentManager to store a filename that is later interpolated into inline Share event handlers ...

POC-CVE-2026-19679

CVE-2026-19679 — insufficient sanitization of uploaded filenames input validation Status: CONFIRMED on a 6.7.2-14.el9 lab 2026-08-20. POST /rest/auditFile with tailoringOriginalFilename = "poc;touch$IFSpoc19679;me.xml" returned HTTP 200 and registered AuditFile 1000002 — the shell-metachar filena...

CVE-2025-5880

Whistle 2.9.98 contains an unpatched path traversal vulnerability because the /cgi-bin/sessions/get-temp-file endpoint fails to adequately sanitize user input in the filename parameter. By supplying absolute paths or traversal sequences like /etc/passwd, an attacker can bypass directory...

CVE-2025-69212-PoC

CVE-2025-69212 — OpenSTAManager P7M Command Injection PoC OpenSTAManager = 2.9.8 — OS Command Injection via malicious .p7m filename in ZIP upload. File: src/Util/XML.php:100 — unsanitized $file in exec Vector: /plugins/importFEZIP/actions.php → ZIP → .p7m filename → exec"openssl smime ... -in...

CVE-2026-104269

GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules...

PT-2026-107102

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

UBUNTU-CVE-2026-104269

GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules...

GHSA-85C8-PPGW-CCPR Tinypool: Prototype Pollution Gadget to RCE in run() options

tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.runtask, options is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype. An attacker wh...

Tinypool: Prototype Pollution Gadget to RCE in run() options

tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.runtask, options is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype. An attacker wh...

EUVD-2026-63829

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name...

GHSA-GXM5-99CW-XJW9 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

CVE-2022-29597

CVE-2022-29597: Inclusión de Archivos Locales en RSS v500 La aplicación RRS v500 de Solutions Atlantic es vulnerable a una vulnerabilidad de Inclusión de Archivos Locales LFI. Cualquier usuario autenticado tiene la capacidad de hacer referencia a archivos internos del sistema en las solicitudes...

CVE-2025-69212

CVE-2025-69212 Descripción OpenSTAManager es una solución de software de gestión para asistencia técnica, facturación electrónica y contabilidad. Las versiones =2.9.8 son vulnerables a una vulnerabilidad de ejecución remota de código autenticada. Un atacante puede explotar este problema cargando ...

CVE-2024-34833-payroll-management-system-rce

CVE-2024-34833 Payroll Management System RCE Sin autenticación PoC RCE mediante carga de archivos para https://www.sourcecodester.com/php/14475/payroll-management-system-using-phpmysql-source-code.html. Los nombres de archivo tienen una marca de tiempo antepuesta con precisión de minuto. El scrip...

Path Traversal

Apache Kyuubi is vulnerable to Path Traversal. The vulnerability is due to the use of the client‑supplied multipart filename when creating a temporary uploaded resource, where the filename is not validated and path traversal sequences such as ../ can be included, allowing a remote attacker to wri...

CVE-2020-5398

CVE-2020-5398 - RFDReflected File Download Attack for Spring MVC In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header...