CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...

EUVD-2026-62397

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

PT-2020-9959

Name of the Vulnerable Software and Affected Versions: Management Center affected versions not specified Description: A CSRF token disclosure issue allows a remote attacker, with access to an authenticated Management Center user's web browser history or a network device that intercepts/logs traff...

CVE-2019-18376: Cross-Site Request Forgery (CSRF)

A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center MC user's web browser history or a network device that intercepts/logs traffic to MC, to obtain CSRF tokens and use them to perform CSRF attacks against MC...

Smule: Web cache poisoning leads to disclosure of CSRF token and sensitive information

Summary: The page https://www.smule.com/s/smulegroups/usergroups/username is vulnerable to web cache poisoning. Description: The page https://www.smule.com/s/smulegroups/usergroups/username is vulnerable to web cache poisoning, on adding X-Forwarded-Host header to the request multiple request lin...

PT-2018-11802

Name of the Vulnerable Software and Affected Versions Atlassian Jira versions prior to 7.6.9 Atlassian Jira versions 7.7.0 through 7.7.5 Atlassian Jira versions 7.8.0 through 7.8.5 Atlassian Jira versions 7.9.0 through 7.9.3 Atlassian Jira versions 7.10.0 through 7.10.3 Atlassian Jira versions...