39 matches found
CVE-2026-63157
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
CVE-2026-63157
The Omnispace Agora Project versions prior to 26.10.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability in the Links module . The root cause is the failure to neutralize quotes when echoing an unsanitized link address (adress) field into an onclick event-handler attribute. An aut...
CVE-2026-63157 Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
Contao: Improper access control in the preview links module
core-bundle/config/services.yaml registers the preview access voter with the class Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, but the class shipped on disk is named PreviewVoter. Symfony resolves the class with getReflectionClass$class, false, gets null, silently skips the...
CVE-2026-107850
The Contao Open Source CMS is vulnerable to improper access control in the preview links module from versions 5.7.1 until 5.7.12 . The root cause is a configuration error in core-bundle/config/services.yaml, where the preview access voter is registered under an incorrect class name. This causes S...
EUVD-2026-95980
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...
CVE-2026-107850 Contao: Improper access control in the preview links module
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...
CVE-2026-107850 Contao: Improper access control in the preview links module
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and...
Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...
EUVD-2007-2368
Malware in sbrugna...
EUVD-2020-13136
Malware in sbrugna...
EUVD-2015-5452
Malware in sbrugna...
CVE-2020-20349
WTCMS 1.0 contains a stored cross-site scripting XSS vulnerability in the link address field under the background links module...
CVE-2024-36684
In the module "Custom links" pkcustomlinks = 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection...
PT-2024-40169
Name of the Vulnerable Software and Affected Versions: Contextual Links module affected versions not specified Description: The issue arises from insufficient validation of requested contextual links by the Contextual Links module. However, the risk is somewhat mitigated because an attacker would...
PT-2024-40345 · Unknown · Contextual Links
Name of the Vulnerable Software and Affected Versions: Contextual Links module affected versions not specified Description: The issue arises from insufficient validation of requested contextual links by the Contextual Links module. However, the risk is mitigated because an attacker would need to...
SUSE CVE-2003-0279
Multiple SQL injection vulnerabilities in the WebLinks module for PHP-Nuke 5.x through 6.5 allows remote attackers to steal sensitive information via numeric fields, as demonstrated using 1 the viewlink function and cid parameter, or 2 index.php...
CVE-2020-20349
WTCMS 1.0 contains a stored cross-site scripting XSS vulnerability in the link address field under the background links module...
