GO-2026-5651 Mattermost doesn't check the create_post channel permission during post edit operations in github.com/mattermost/mattermost-server

Mattermost doesn't check the createpost channel permission during post edit operations in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-54361

CVE-2026-54361 affects MISP and stems from mass assignment flaws in collections, tag collections, event delegations, and shadow attributes. Several controller actions accepted user-supplied fields that should be server-controlled (e.g., id, org_id, orgc_id, user_id), enabling an authenticated att...

CVE-2026-53911

Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows. In affected entities that did not explicitly mark id as inaccessible, an authenticated attacker could submit a crafted edit...

CVE-2026-53911 Cerebrate primary key mass assignment in CRUD edit operations allows authenticated users to overwrite unrelated records

Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows. In affected entities that did not explicitly mark id as inaccessible, an authenticated attacker could submit a crafted edit...

CVE-2024-51962

A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced...

CVE-2024-51962

A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced...

CVE-2024-51962: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced...

PYSEC-2024-273

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All...

CVE-2024-42346 Stored Cross Site Scripting (Stored XSS) in Galaxy

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All...

Design/Logic Flaw

The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation...

PT-2021-17751

Name of the Vulnerable Software and Affected Versions: OUGC Feedback plugin versions prior to 1.8.23 for MyBB Description: The issue allows for XSS via the comment field of feedback during an edit operation. Recommendations: For versions prior to 1.8.23, update to version 1.8.23 or later to resol...

CVE-2021-28115: Improper Neutralization of Input During Web Page Generation

The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation...

SeaCMS SQL Injection Vulnerability (CNVD-2020-74059)

SeaCMS Ocean CMS is a professional open source free PHP film and television system. SeaCMS 10.1 2020.02.08 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by using the id parameter in the edit operation of adminmembersgroup.php to perform a SQL injection...

SeaCMS SQL注入漏洞

SeaCMS Ocean CMS is a professional open source free PHP film and television system. SeaCMS 10.1 2020.02.08 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by using the id parameter in the edit operation of adminmembersgroup.php to perform a SQL injection...

WordPress NEX-Forms Lite Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . NEX-Forms Lite is one of the user-defined plugin to create forms . A cross-site scripting vulnerability exists in...