CVE-2026-72608

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...

CVE-2026-18478

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...

EUVD-2026-55624

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...

CVE-2026-18478

Magnolia CMS is affected by a Stored XSS in the import functionality (CVE-2026-18478). An attacker with editor privileges can inject arbitrary HTML/JavaScript into the name of an uploaded image, which is rendered/executed when the image is opened. The issue is fixed in Magnolia CMS version 6.3.10...

CVE-2026-18478

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...

CVE-2026-18478 Stored XSS in Magnolia CMS

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...

CVE-2026-19210

The CVE-2026-19210 vulnerability affects SourceCodester Photo Share Website 1.0, specifically the file /social/ajax.php?action=save_upload. The issue arises from manipulation of the arguments img[]/imgName[], which can lead to an unrestricted file upload. This could allow remote attackers to uplo...

CVE-2026-19210

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=saveupload. Such manipulation of the argument img/imgName leads to unrestricted upload. The attack may be launched remotely. The exploit has be...

CVE-2026-19210 SourceCodester Photo Share Website ajax.php save_upload unrestricted upload

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=saveupload. Such manipulation of the argument img/imgName leads to unrestricted upload. The attack may be launched remotely. The exploit has be...

UBUNTU-CVE-2026-56136

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfsirnill in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name...

EUVD-2026-38201

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

CVE-2026-12815

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

CVE-2026-12815

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

CVE-2026-12815

CVE-2026-12815 affects coollabsio coolify 4.0.0, specifically the Image Name Handler component. The vulnerability is an os command injection caused by manipulation in the image name processing, with a remote attack vector and low-privilege conditions. The CVSS metrics indicate network access, low...

CVE-2026-12815 coollabsio coolify Image Name os command injection

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

CVE-2026-12815 coollabsio coolify Image Name os command injection

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

PT-2026-51262

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

EUVD-2017-18974

Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. Attackers can send requests to asgallDownload.php with directory traversal sequences ../ to access sensitive files outside the...

PT-2026-47771

Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. Attackers can send requests to asgallDownload.php with directory traversal sequences ../ to access sensitive files outside the...

RHCOS 4 : OpenShift Container Platform 4.8.31 (RHSA-2022:0483)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0483 advisory. - jenkins: no POST request is required for the endpoint handling manual build requests which could result in CSRF CVE-2022-20612 -...