15 matches found
CVE-2026-88421
Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...
CVE-2026-88420
A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...
CVE-2026-88421: Improper Access Control
Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...
CVE-2026-88421
Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...
PT-2026-98825
Name of the Vulnerable Software and Affected Versions APSL puput versions 1.2.1 through 2.2.0 Description A reflected cross-site scripting XSS issue exists in the EntryAbstract.save function. This allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code within the...
CVE-2026-88420
A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...
EUVD-2026-87082
A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...
CVE-2026-88421
Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...
CVE-2026-88421
Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...
CVE-2026-88420
A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...
CVE-2026-88420: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...
CVE-2026-88420
A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...
PT-2026-98840
Incorrect access control in the BlogPage.get entries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...
CVE-2026-88420
A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput versions v1.2.1 through v2.2.0 . This flaw allows authenticated attackers possessing Wagtail Editor privileges to execute arbitrary code within a victim's browser by providing a crafted...
CVE-2026-88421
APSL puput versions v1.2.1 through v2.2.0 are vulnerable to an incorrect access control flaw in the BlogPage.get_entries() component. This vulnerability allows unauthenticated attackers to view restricted blog entries through multiple access points, including the blog index, tag, category, author...