47 matches found
CVE-2026-63157
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
CVE-2026-63157 Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
CVE-2026-63157 Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
EUVD-2026-100475
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
CVE-2026-63157
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
CVE-2026-63157 Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
CVE-2026-63157
The Omnispace Agora Project versions prior to 26.10.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability in the Links module . The root cause is the failure to neutralize quotes when echoing an unsanitized link address (adress) field into an onclick event-handler attribute. An aut...
PT-2026-113375
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
CVE-2026-63157: Improper Neutralization of Input During Web Page Generation
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
Contao: Improper access control in the preview links module
core-bundle/config/services.yaml registers the preview access voter with the class Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, but the class shipped on disk is named PreviewVoter. Symfony resolves the class with getReflectionClass$class, false, gets null, silently skips the...
CVE-2026-107850 Contao: Improper access control in the preview links module
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...
CVE-2026-107850 Contao: Improper access control in the preview links module
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...
CVE-2026-107850
The Contao Open Source CMS is vulnerable to improper access control in the preview links module from versions 5.7.1 until 5.7.12 . The root cause is a configuration error in core-bundle/config/services.yaml, where the preview access voter is registered under an incorrect class name. This causes S...
EUVD-2026-95980
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...
CVE-2026-107850 Contao: Improper access control in the preview links module
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...
Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...
Improper access control in the preview links module
Date : 2026-08-25 CVE ID : CVE-2026-107850 Description A backend user can edit preview links that they do not have permission to access. Affected versions Contao 5.7.1 up to 5.7.11 Suggested solution Upgrade to Contao 5.7.12. Workaround Revoke access to the preview links module. More information...
EUVD-2020-13136
Malware in sbrugna...