265 matches found
CVE-2025-11174
CVE-2025-11174: Document Library Lite WordPress 플러그인의 인증되지 않은 정보 노출 키워드: CVE-2025-11174, Document Library Lite 취약점, 정보 노출, WordPress 보안, 인증되지 않은 AJAX 악용, WordPress 플러그인 취약점, CWE-862, WordPress 문서 플러그인 보안, 인증 우회, WordPress CVE 2025 목차 개요 취약점 세부 정보 기술 분석 공격 경로 개념 증명 해결 가이드 탐지 CVSS 점수 참고 자료 크레딧 보안 연...
CVE-2026-81895
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...
CVE-2026-81895
Concrete CMS before 9.5.3 is affected by a stored, time-based blind SQL injection in the Document Library block . The block stored file-set identifiers submitted via fsID[] without validating them as integers. When configured with setMode=any, each stored identifier was concatenated directly into...
EUVD-2026-78837
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...
CVE-2026-81895 Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...
CVE-2026-81895 Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...
CVE-2026-81895 Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...
PT-2026-92129
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...
CVE-2026-81895: Improper Neutralization of Special Elements used in an SQL Command
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...
Astra Linux – Vulnerability in pypdf2
PyPDF2 is an open-source Python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5, an attacker who exploited this vulnerability could create a PDF that would cause an infinite loop if the PyPDF2 code attempted to access the...
CVE-2026-81917
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...
CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...
CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...
EUVD-2026-76689
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...
CVE-2026-81917
Concrete CMS versions below 9.5.3 contain a Stored XSS vulnerability in the Document Library block . The block controller returned the file description and tags values without applying the h() HTML-escaping function (already used for the title column), and the block view template wrote those valu...
CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...
PT-2026-90498
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...
CVE-2026-81917: Improper Neutralization of Input During Web Page Generation
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...