2068 matches found
CVE-2026-73332
CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...
PT-2026-70099
Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description An issue exists where a tag's icon value can be stored and subsequently interpolated into HTML using Vue's v-html directive. The mapIcon function previously constructed an HTML string...
CVE-2026-19384 SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...
CVE-2026-17598 Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...
CVE-2026-45378
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...
CVE-2026-45378 Decidim: Verification documents can be downloaded through reusable links
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...
CVE-2026-45378
CVE-2026-45378 affects Decidim where the identity-document verification admin UI embeds verification_attachment blobs using reusable signed Active Storage disk URLs. The implementation renders images with variant_url(...), producing signed /rails/active_storage/disk/... links that bypass authoriz...
EUVD-2026-54254
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...
keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...
CVE-2026-7326
The CVE-2026-7326 issue affects Progress MarkLogic Server Admin UI prior to versions 11.3.6 and 12.0.3. It is a cross-site request forgery (CSRF) vulnerability where an attacker lures an authenticated administrator to a malicious page to perform actions on behalf of the admin, potentially causing...
CVE-2026-7326
A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...
CVE-2026-15920
A flaw was found in Django. The django.contrib.admin.utils.displayforfield function renders URLField values as clickable links in the administrative interface without proper validation. If an application persists URLField data containing an unsafe scheme without running model validation, a remote...
EUVD-2026-39021
Ghost: File Upload Content-Type Spoofing...
Cross-site Scripting (XSS)
Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the displayforfield function. An attacker can execute arbitrary JavaScript code in the context of th...
PT-2026-67753
Name of the Vulnerable Software and Affected Versions Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7 Description An issue exists where django.contrib.admin.utils.display for field renders URLField values as clickable links in the admin interface without proper validation. Th...
Linux Distros Unpatched Vulnerability : CVE-2026-15920
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links ...
CVE-2026-16105
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...
EUVD-2026-51265
SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...