Esri Portal for ArcGIS 11.1 / 11.3 < Security 2026 Update 3 HTML Injection (CVE-2026-69237)

The version of Esri Portal for ArcGIS installed on the remote host is 11.1 or 11.3 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - An HTML injection vulnerability exists in Esri Portal for ArcGIS that allows a remote attacker with administrative...

CVE-2023-31711

CVE-2023-31711 Incorrect Access Control in ZKTECO allows remote attackers to read any file via the administrative API. Installing required modules Inside the directory ZKTEco: $ pip install -r ./pyzatt/requirementsdev.txt Running the exploit Inside the directory ZKTEco: $ python exploit.py...

Couchbase Server - Broken Access Control

Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit require...

CVE-2026-69237

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69237

CVE-2026-69237 is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior . A remote attacker with administrative privileges can insert arbitrary HTML into an administrative API. Esri rates the severity as LOW (CVSS 3.8) , while NVD rates it MEDIUM (4.8) , with the key d...

EUVD-2026-64085

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

PT-2026-79470

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.3 Description An HTML injection issue exists that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. HTML injection is a technique where an...

PT-2026-65740

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the administrative API used to manage identity providers and organizations. An administrator with permissions to manage identity providers can link a new provider to an...

CVE-2026-17048

The CVE-2026-17048 affects Keycloak’s Admin REST API handling of rotated client secrets stored in a secure vault. The root cause is improper boundary enforcement, allowing a delegated administrator with view-only permissions to retrieve the actual resolved secret instead of the vault placeholder,...

PT-2026-60541

Name of the Vulnerable Software and Affected Versions Keycloak server affected versions not specified Description A flaw exists in the group search functionality of the administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access...

CVE-2026-35552

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's...

CVE-2026-5842

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has...

GHSA-XRRH-P7F2-27VM decolua 9router vulnerable to authorization bypass

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has...

decolua 9router vulnerable to authorization bypass

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has...

Authorization Bypass Through User-Controlled Key

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the /api/ endpoints of the Administrative API. An attacker can gain unauthorized access to administrative functions by sendi...

CVE-2026-5842

CVE-2026-5842 concerns decolua 9router (≤0.3.47) where the Administrative API Endpoint under /api can bypass authorization. The root cause is described as an unauthorized access vulnerability in an unknown function of the API endpoint, exploitable remotely. Public disclosure has occurred and the ...

CVE-2026-5842 decolua 9router Administrative API Endpoint api authorization

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-5842

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has...

decolua 9router vulnerable to authorization bypass

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has...