EUVD-2026-62951

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and...

CVE-2026-76386

In Zoom app for Splunk SOAR versions below 3.2.2, the "password" and "pmi_password" action parameters are not masked, causing cleartext exposure of Zoom meeting passwords and personal meeting ID passwords in the UI when a user with action-running privileges invokes create/update meeting or update...

CVE-2026-76385

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...

CVE-2026-72827

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

CVE-2026-72827 Grav CMS before 2.0.13 Remote Code Execution via Twig

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

CVE-2019-25734

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint...

wordpress plugin Contact Form 路径遍历漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

GHSA-V8WV-JG3Q-QWPQ OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

Summary The message tool accepted mediaUrl and fileUrl aliases without applying the same sandbox localRoots validation as the canonical media path handling. Impact A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters. Affected...

ITFlow 安全漏洞

ITFlow is an open-source IT documentation, ticket management, and billing ERP software developed by ITFlow. Versions of ITFlow prior to 10.0.0 contained security vulnerabilities. These vulnerabilities stemmed from insufficient validation of action parameters in the flow/admin/moniteur.php script,...

EUVD-2005-3938

Malware in sbrugna...

Linksys E8450 action parameter buffer overflow vulnerability

The Linksys E8450 is an E-series wireless router from Linksys USA. A buffer overflow vulnerability exists in the Linksys E8450 v1.2.00.360516, which originates when action parameters are copied to the stack without length validation, and can be exploited by a remote attacker to execute arbitrary...

CVE-2024-11974

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smcsettingstab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it...

UBUNTU-CVE-2021-44858

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead...

WordPress PhotoSmash plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.PhotoSmash plugin is a plugin for adding photo albums. The WordPress PhotoSmash plugin has a cross-site scripting lea...

EPShop < 3.0 (pid) Remote SQL Injection Vulnerability

No description provided by source. + Name : EPShop 3.0 pid Remote SQL Injection Vulnerability + Author : mikeX - http://www.cyber-underground.net / m$n: mikeXatfuckoffdotcom + Dorks: ?action=proshow and ?action=disppro + Greetz : Ciaran McG, -Witch-Doct0r, Kn, MegaByte, Squibs, cIpheR, mmmbud,...

STRUTS2 S2-0 2 0 patch bypass vulnerability-vulnerability warning-the black bar safety net

0×0 0 background Security researchers noted that the Apache Struts2 vulnerability Bulletin S2-0 2 0, in process repair CVE-2 0 1 4-0 0 9 4 bug fixes program vulnerability exists, resulting patch is completely bypassed. 0×0 1 Analysis Struts2 S2-0 2 0 was added .\.|^ class\.. to filter action...

CVE-2009-2145

Multiple cross-site scripting XSS vulnerabilities in transLucid 1.75 allow remote attackers to inject arbitrary web script or HTML via the a NodeID and b action parameters to the default URI, and the c NodeID parameter to the default URI for the admin section; and allow remote authenticated users...

CVE-2006-3247

Multiple cross-site scripting XSS vulnerabilities in show.php in GL-SH Deaf Forum 6.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 search, 2 page, and 3 action parameters. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2006-3247

Multiple cross-site scripting XSS vulnerabilities in show.php in GL-SH Deaf Forum 6.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 search, 2 page, and 3 action parameters. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2005-3894

Multiple cross-site scripting XSS vulnerabilities in index.pl in Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 hex-encoded values in the QueueID parameter and 2 Action parameters...