220 matches found
CVE-2022-30190---Follina---Poc-Exploit
Follina - CVE-2022-30190 Follina 是一个零日漏洞，允许在 Office 产品中执行代码。 安装 root@kitploit: git clone https://github.com/WesyHub/CVE-2022-30190---Follina---Poc-Exploit.git 使用 示例： root@kitploit: python3 FollinaSploit.py -c calc -o poc.docx -p 80 请确保将 doc 或 rtf 文件发送到目标。 已在 Office 2019 上测试。 来源...
CVE-2026-88790
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...
EUVD-2026-75507
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...
CVE-2026-88790
proma-ai Proma versions up to 0.19.37 contain a path traversal vulnerability in the File Preview Service component, specifically in the resolveTargetPath function within apps/electron/src/main/lib/file-preview-service.ts. The root cause is a basename-collision fallback that allows an attacker to ...
CVE-2026-88790 proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...
CVE-2026-88790 proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...
PT-2026-89423
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file path leads to path traversal. Local...
PT-2026-70911
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an...
CVE-2026-70486
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...
GHSA-3XPF-XQ7R-V8C5 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
Summary Any authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and the file is serv...
CVE-2026-70486 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...
CVE-2026-70486
Open WebUI (self-hosted AI platform) versions 0.9.0–0.11.0 contain a Same-Origin/XSS risk in the terminal file-preview iframe: the serveUrl iframe branch granted allow-same-origin and allow-scripts for HTML files from the app origin, enabling an authenticated user with terminal server access to r...
CVE-2026-70486 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...
CVE-2026-57917
CVE-2026-57917 affects proCertum SmartSign. The issue is an XML External Entity (XXE) vulnerability where external entities are parsed from crafted signature files, enabling SSRF and potentially local file reads depending on parser configuration. The vulnerability is triggered by previewing a fil...
CVE-2026-40000
The CVE-2026-40000 entry concerns ZTE File Manager’s Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity, used to preview compressed files. Third-party apps can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), allowing acce...
EUVD-2026-49136
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...
CVE-2026-40000 Path Traversal Vulnerability in ZTE Blade A75 5G
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...
PT-2026-64874
Name of the Vulnerable Software and Affected Versions ZTE File Manager affected versions not specified Description The zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity activity is intended to preview compressed files. Third-party applications can launch this activity and provide arbitrary fi...
PYSEC-2026-2731 Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
Related advisory This advisory tracks a regression of the original Excel-preview XSS that was publicly disclosed and patched under GHSA-jwf8-pv5p-vhmc patched in v0.8.0. The same root cause — XLSX.utils.sheettohtml output rendered via @html excelHtml without DOMPurify — was reintroduced sometime...
PT-2026-50483
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description The application renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel:...