CVE-2026-89256 AVideo Bookmark Plugin Stored XSS via Chapter Names

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89256: Improper Neutralization of Input During Web Page Generation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

PT-2026-89859

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

CVE-2026-53620

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

CVE-2026-53620

GROWI contains an authorization bypass (CWE-639) in the bookmark folder APIs , caused by a user-controlled key. An authenticated attacker can retrieve, tamper with, or delete another user's bookmark data. The CVSS 3.0 score is 6.3 (Medium) and CVSS 4.0 is 5.3 (Medium) , reflecting network vector,...

EUVD-2026-68371

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

CVE-2026-53620

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

CVE-2026-53620

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

EUVD-2026-68370

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

CVE-2026-68951

GROWI, a platform by GROWI, Inc., contains an incorrect authorization flaw (CWE-863) in its bookmark listing APIs . An unauthenticated attacker could retrieve other users' bookmark data, resulting in a low confidentiality impact . The CVSS 3.1 base score is 5.3 (MEDIUM) ; CVSS 4.0 rates it 6.9 (M...

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

PT-2026-83705

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

CVE-2026-53620: Authorization Bypass Through User-Controlled Key

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

CVE-2026-68951: Incorrect Authorization

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

PT-2026-83707

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

Multiple vulnerabilities in GROWI

Overview GROWI provided by GROWI, Inc. contains multiple vulnerabilities listed below: Authorization bypass through user-controlled key in the bookmark folder APIs CWE-639 - CVE-2026-53620 Incorrect authorization in the bookmark listing APIs CWE-863 - CVE-2026-68951 CVE-2026-53620 Masashi Kawamot...

CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...