CVE-2023-43770-PoC

CVE-2023-43770-PoC CVE-2023-43770 の保存型 XSS 脆弱性の PoC 説明 Roundcube 1.4.14 未満、1.5.x の 1.5.4 未満、および 1.6.x の 1.6.3 未満では、program/lib/Roundcube/rcubestringreplacer.php の動作により、細工されたリンクを含む text/plain 形式の電子メールメッセージを介した XSS が可能になります。 攻撃チェーン 細工されたメール - 被害者がメールを受信し開封 - JavaScript の実行（保存型） PoC 動画:...

CVE-2023-43770-POC

CVE-2023-43770 POC 最近発見されたCVE-2023-43770脆弱性の概念実証（Proof-of-Concept）です。 Roundcube 1.4.14より前、1.5.xは1.5.4より前、1.6.xは1.6.3より前のバージョンでは、program/lib/Roundcube/rcubestringreplacer.phpの動作により、巧妙に細工されたリンクを含むtext/plainの電子メールメッセージを介してXSSが可能になります。 使用法 root@kitploit: python cve-2023-43770.py -e...

CVE-2026-20841

🛡️ CVE-2026-20841 - Windows Notepad セキュリティテストツール ⚠️ CVE-2026-20841 とは何ですか？ CVE-2026-20841 は、Windows Notepad アプリケーションにおける既知のセキュリティ上の弱点です。この脆弱性は、Notepad がクリック可能なリンクを含む書式付きテキストを表示できるマークダウン機能に影響します。この弱点は、Notepad 内で動作するマークダウンエンジンが許可するリンクの種類（URLプロトコルと呼ばれる）を制限しないために発生します。つまり、攻撃者は、クリックされると Notepad...

CVE-2026-76960

SAP S/4HANA Finance (Advanced Payment Management) is affected by a Cross-Site Request Forgery (CSRF) vulnerability caused by insufficient CSRF protection on certain requests. An attacker with low privileges can craft a malicious link or page; when an authenticated victim interacts with it, uninte...

Astra Linux – Vulnerability in LibreOffice

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so that it does not match the denylist, resulting in ShellExecute attempting to launch an executable file...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

EUVD-2026-54296

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

CVE-2026-48911

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...

CVE-2026-66300

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

EUVD-2026-52869

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

GHSA-5VJC-7CXW-4W6J Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Summary The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service ReDoS. Details The RegExp for convolution is defined as...

CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

PT-2026-64214

Name of the Vulnerable Software and Affected Versions React Router versions 6.30.2 through 6.30.4 React Router versions 7.9.6 through 7.12.0 Description Applications that allow open redirects are susceptible to Cross-Site Scripting XSS, a technique where malicious scripts are injected into truste...

Plone < 3.3.6 XSS

The version of Plone installed on the remote host is prior to 3.3.6. It is, therefore, affected by a cross-site scripting XSS vulnerability, in PortalTransforms due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by...

EUVD-2026-46045

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-44752

CVE-2026-44752 affects SAP NetWeaver Application Server Java (often noted with the Configuration Wizard). The vulnerability is a Cross-Site Scripting (XSS) issue where an unauthenticated attacker can inject malicious JavaScript through crafted URLs. When a victim loads such a URL, the script runs...

OPENSUSE-SU-2026:21208-1 Security update for cockpit

This update for cockpit fixes the following issue - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI bsc1265040...

EUVD-2026-41054

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php lines 119, 129. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

PT-2026-54015

Name of the Vulnerable Software and Affected Versions Storage Concentrator SC & SCVM affected versions not specified Description Reflected cross-site scripting occurs because unsanitized content is echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an...