Lucene search
+L

26109 matches found

OSV
OSV
added 2026/05/08 7:38 p.m.65 views

GHSA-2R4P-JPMG-48F4 Open WebUI has an LDAP Empty Password Authentication Bypass

LDAP Empty Password Authentication Bypass Affected Component LDAP authentication endpoint: - backend/openwebui/routers/auths.py lines 468-477, user bind with empty password - backend/openwebui/models/auths.py lines 58-60, LdapForm model Affected Versions Current main branch commit 6fdd19bf1 and...

9.1CVSS6AI score0.01461EPSS
SaveExploits1References3
Github Security Blog
Github Security Blog
added 2026/05/08 4:54 p.m.21 views

PrestaShop has a stored XSS executable in customer service view

Impact This is a stored Cross-site Scripting XSS vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee open...

9.3CVSS5.8AI score0.00331EPSS
SaveExploits0References2Affected Software1
Snyk
Snyk
added 2026/05/08 4:54 p.m.14 views

Cross-site Scripting (XSS)

Overview prestashop/prestashop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Customer Service view process. An attacker can...

9.3CVSS5.8AI score0.00331EPSS
SaveExploits0References2
NVD
NVD
added 2026/05/08 3:16 p.m.18 views

CVE-2026-41576

Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible no authentication required. User-supplied message text is passed through PHP's nl2br function, which converts newlines to tags but does not escape HTML. The resulting string is then passed to a Blade...

7.1CVSS0.00271EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/08 2:50 p.m.18 views

EUVD-2026-28652

Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible no authentication required. User-supplied message text is passed through PHP's nl2br function, which converts newlines to tags but does not escape HTML. The resulting string is then passed to a Blade...

7.1CVSS5.9AI score0.00271EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/05/08 2:50 p.m.13 views

CVE-2026-41576

Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible no authentication required. User-supplied message text is passed through PHP's nl2br function, which converts newlines to tags but does not escape HTML. The resulting string is then passed to a Blade...

7.1CVSS5.9AI score0.00271EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/05/08 2:50 p.m.45 views

CVE-2026-41576 Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade Template

Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible no authentication required. User-supplied message text is passed through PHP's nl2br function, which converts newlines to tags but does not escape HTML. The resulting string is then passed to a Blade...

7.1CVSS0.00271EPSS
SaveExploits0References2
CVE
CVE
added 2026/05/08 2:50 p.m.31 views

CVE-2026-41576

Brave CMS is affected by CVE-2026-41576 due to a public contact form that accepted user messages without authentication before commit 6c56603. The message text is passed through nl2br() (converting newlines to ) but is not HTML-escaped, and is then rendered in a Blade email template using the une...

7.1CVSS5.9AI score0.00271EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/05/08 12:35 p.m.13 views

CVE-2022-50994 DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit...

9.2CVSS6.6AI score0.01432EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/05/08 11:24 a.m.18 views

CVE-2026-3318

Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘returnUrl’ parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result,...

5.3CVSS5.8AI score0.00339EPSS
SaveExploits0References2
CVE
CVE
added 2026/05/08 11:24 a.m.45 views

CVE-2026-3318

The CVE-2026-3318 entry documents an open redirection in the Cradle eCommerce platform (latest demo version) affecting the login form endpoint. The vulnerability arises because the returnUrl parameter accepts a URL without proper validation, enabling an attacker to redirect users from a legitimat...

5.3CVSS5.8AI score0.00339EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/05/08 11:24 a.m.49 views

CVE-2026-3318 Multiple vulnerabilities in Cradle e-commerce

Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘returnUrl’ parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result,...

5.3CVSS0.00339EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/05/08 11:24 a.m.16 views

CVE-2026-3318 Multiple vulnerabilities in Cradle e-commerce

Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘returnUrl’ parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result,...

5.3CVSS5.8AI score0.00339EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/08 6:32 a.m.14 views

EUVD-2022-28877

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface...

6.1CVSS5.8AI score0.00201EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/05/08 4:15 a.m.10 views

CVE-2026-8138 Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based overflow

A vulnerability was found in Tenda CX12L 16.03.53.12. This issue affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg”. The manipulation results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used...

9CVSS7.8AI score0.00568EPSS
SaveExploits1References5
CVE
CVE
added 2026/05/08 4:15 a.m.38 views

CVE-2026-8138

CVE-2026-8138 affects Tenda CX12L 16.03.53.12. The flaw is located in the function formSetPPTPServer of the file /goform/SetPptpServerCfg and causes a stack-based buffer overflow. The issue is exploitable remotely, with an exploit publicly available. Connected sources consistently describe the vu...

9CVSS7.8AI score0.00568EPSS
SaveExploits1References5Affected Software1
Positive Technologies
Positive Technologies
added 2026/05/08 12:0 a.m.19 views

PT-2026-39255

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 4.2.2 Description The NRF root SBI endpoint "POST /oauth2/token" contains a parser-level type-confusion bug. The handler in NFs/nrf/internal/sbi/api accesstoken.go uses reflection over...

7.5CVSS5.8AI score0.00394EPSS
SaveExploits1
CNNVD
CNNVD
added 2026/05/08 12:0 a.m.22 views

Brave CMS 跨站脚本漏洞

Brave CMS is a blog and news content management system developed by Razvan Zamfir, based on Laravel. Brave CMS has a cross-site scripting vulnerability, which stems from the fact that the message text entered in the contact form was not escaped properly, potentially allowing for arbitrary tag...

7.1CVSS5.8AI score0.00271EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/05/08 12:0 a.m.11 views

Node.js Module axios < 1.15.1 CRLF Injection (CVE-2026-42037)

The version of the axios Node.js module installed on the remote host is prior to 1.15.1. It is, therefore, affected by the following vulnerability: - CRLF injection in multipart/form-data body via unsanitized blob.type in formDataToStream. CVE-2026-42037 Note that Nessus has not tested for this...

5.3CVSS5.8AI score0.00294EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2026/05/08 12:0 a.m.19 views

PT-2026-39140

Name of the Vulnerable Software and Affected Versions Brave CMS versions prior to commit 6c56603 Description The contact form is publicly accessible without authentication. User-supplied message text is processed by the nl2br function, which converts newlines to tags but fails to escape HTML. Thi...

7.1CVSS5.9AI score0.00271EPSS
SaveExploits0References5
Rows per page
Query Builder