CVE-2026-27198 Formwork Improperly Manages Privileges During User Creation

Formwork is a flat file-based Content Management System CMS. In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has...

CVE-2026-27192

creationtimestamp| type| source ---|---|--- 2026-02-21 04:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116106738236454635 2026-02-21 04:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfdrzpjksa2c...

CVE-2026-2124

creationtimestamp| type| source ---|---|--- 2026-02-21 01:03:01+00:00| seen| https://bsky.app/profile/infosecbot.bsky.social/post/3mfdggpvvt72p...

CVE-2026-22374

creationtimestamp| type| source ---|---|--- 2026-02-21 00:48:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfdfmbvhhz26...

CVE-2026-22376

creationtimestamp| type| source ---|---|--- 2026-02-21 00:45:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfdfgibsak2t...

CVE-2026-27198: Improper Privilege Management

Formwork is a flat file-based Content Management System CMS. In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has...

Formwork 安全漏洞

Formwork is an open-source content management system CMS developed by Formwork. It is used to build and manage simple websites. Versions 2.0.0 to 2.3.3 of Formwork have security vulnerabilities. These vulnerabilities stem from improper role-based authorization during account creation, which may...

CVE-2019-25454

phpMoAdmin 1.1.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the collection parameter. Attackers can send GET requests to moadmin.php with script payloads in the collection parameter during collection...

CVE-2019-25448

OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the document endpoint with JavaScript code in the name field to...

CVE-2019-25447

OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes,...

CVE-2019-25448

OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the document endpoint with JavaScript code in the name field to...

CVE-2019-25451

phpMoAdmin 1.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized database operations by crafting malicious requests. Attackers can trick authenticated users into submitting GET requests to moadmin.php with parameters like action, db, and collectio...

CVE-2019-25448 OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation

OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the document endpoint with JavaScript code in the name field to...

CVE-2019-25448 OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation

OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the document endpoint with JavaScript code in the name field to...

CVE-2019-25448

OrientDB 3.0.17 is affected by a stored cross-site scripting (XSS) vulnerability. An authenticated attacker can create users with a script payload in the name parameter and post to the document endpoint to inject JavaScript that executes when other users view the application. The published data i...

CVE-2026-2739

creationtimestamp| type| source ---|---|--- 2026-02-20 22:40:40+00:00| seen| https://gist.github.com/alon710/385828216ee91709a87b6de0813d1ccc...

CVE-2026-27112

Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in...

GHSA-GV8R-9RW9-9697

creationtimestamp| type| source ---|---|--- 2026-02-20 21:40:40+00:00| seen| https://gist.github.com/alon710/4cd1875c786b514610f28029ba8d8c98...

GHSA-38C4-R59V-3VQW

creationtimestamp| type| source ---|---|--- 2026-02-20 21:29:26+00:00| seen| https://gist.github.com/adamdjbrett/1af155b4bb15dd7a0f1b3e6323ef48b8...

CVE-2026-27112 Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in...