CVE-2020-28458

CVE-2020-28458 Affected versions of this package are vulnerable to Prototype Pollution. datatables v1.10.16-1.10.16 run python file and it will ask for url, enter url...

28458

CVE-2020-28458 Affected versions of this package are vulnerable to Prototype Pollution. datatables v1.10.16-1.10.16 Usage Run the Python script and enter the required inputs: Target URL Proxy URL optional, leave blank if none Timeout in seconds default 10 Example: python3 exploit.py The script us...

cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection

cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1...

DRUPAL-CONTRIB-2026-226

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...

PT-2026-120904

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...

PT-2026-116484

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory data.php that allows authenticated users to bypass the inventory module enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory...

CVE-2026-111914: Missing Authorization

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...

Admidio authorization issue vulnerability

The Admidio versions from 5.0.11 to 5.0.16 have a vulnerability related to authorization. This vulnerability stems from improper access control in modules/inventory/inventorydata.php. Attackers who are already authenticated can bypass the restrictions of the inventorymoduleEnabled setting by maki...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.2.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-104714 via org.apache.struts:struts2-core (>=7.0.0, <=7.3.0)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.3.0 and more Source cves: CVE-2026-104714 Source advisory: MEND:CVE-2026-104714...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.2.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-104712 via org.apache.struts:struts2-core (>=7.0.0, <=7.3.0)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.3.0 and more Source cves: CVE-2026-104712 Source advisory: MEND:CVE-2026-104712...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.2.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-104711 via org.apache.struts:struts2-core (>=7.0.0, <=7.3.0)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.3.0 and more Source cves: CVE-2026-104711 Source advisory: MEND:CVE-2026-104711...

CVE-2026-59671

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesdatatable” is affected...

CVE-2026-59671 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesdatatable” is affected...

EUVD-2026-91328

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesdatatable” is affected...

CVE-2026-59671

The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The specific affected endpoint is “/es/datatables/getemployeetypesdatatable” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim’s browser. No specific ...

CVE-2026-59671 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesdatatable” is affected...

PT-2026-104162

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesdatatable” is affected...

CVE-2026-59671: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesdatatable” is affected...

CVE-2026-92584

AVideo through 29.0 current revision e01e41ecc contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save, which writes the caller's User-Agent via getUserAgentInfo, which returns unrecognized age...