Kotaemon-CVE-2025-56526-56527-disclosure

Kotaemon CVE-2025-56526 et CVE-2025-56527 : divulgation publique Le Cross-Site Scripting stocké dans le panneau d'information de Kotaemon se combine au stockage d'identifiants en clair dans localStorage, permettant la compromission complète de la session à partir d'un simple PDF malveillant...

CVE-2020-12432

CVE-2020-12432 Collabora CODE = 4.2.2 - API WOPI de Vereign : XSS stocké et autorisations non sécurisées détournement de compte - 4.2.2 Versions concernées : Collabora CODE = 4.2.2 Conditions d'exploitation : L'interface API /wopi/ de Vereign doit être accessible à l'aide du jeton généré fourni, ...

CVE-2024-4367-POC-PDFJS

CVE 2024 4367: PoC لاستغلال XSS Cross-Site Scripting 1. عرض تنبيه تفعيل XSS مثال آخر على الاستغلال يتمثل في حقن رسالة تنبيه بسيطة للتحقق من نجاح الهجوم. root@kitploit: python poc.py "alert'XSS exploit triggered';" الشرح : يحقن هذا الكود نافذة تنبيه منبثقة في الصفحة، مما يتيح اختبار ما إذا كان...

br0w

br0w اخترق Br0w | العب بمتصفحك وتعلم المزيد، استمتع بالاختراق!! Br0w هو تطبيق ويب بسيط لتعلم أساسيات أمن الويب باستخدام المتصفح كأداة يغفل عنها الناس أحيانًا رغم فوائدها العديدة. قد يكون أشبه بـ Capture The Flag CTF. أحد التحديات هو تعطيل CSS وفك الترميز base64 عبر وحدة التحكم، العب أكثر على...

CVE-2026-74234 Legora < 2026-08-14 XSS via Mermaid gray-matter JavaScript Engine

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

EUVD-2026-60437

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-74234

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

PT-2026-76764

Name of the Vulnerable Software and Affected Versions Legora versions prior to 2026-08-14 Description A cross-site scripting issue exists where attackers can execute arbitrary JavaScript in a victim's browser. This occurs when a Mermaid block is prefixed with a gray-matter JavaScript front-matter...

CVE-2026-70492

Open WebUI had a stored XSS vulnerability in KaTeX render-fallback: between 0.10.0 and 0.11.0, KaTeX errors could be rendered via HTML (via {@html}) in rendered messages, allowing script execution in viewers’ browsers and risking session token theft and potential admin account takeovers. Affected...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729 Loytec LWEB802: Exposure of Sensitive Information in browser localStorage

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729

The CVE-2026-55729 entry concerns Loytec LWEB802 (before 5.0.8) where a vulnerability in the browser localStorage can expose management credentials. An unauthenticated remote attacker can leak credentials via a crafted link. Product: Loytec LWEB802; component: browser localStorage; root cause: in...

PT-2026-64301

Name of the Vulnerable Software and Affected Versions Loytec LWEB-802 versions prior to 5.0.8 Description An issue exists where sensitive information is exposed within the browser localStorage. This allows an unauthenticated remote attacker to leak stored management credentials by using a crafted...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file-download API endpoint in the LocalStorage process. An attacker can access arbitrary files on the server filesystem, including sensitive data such as embedded databases, secrets, and environment variables...

CVE-2026-49984

CVE-2026-49984 – Kestra : A path traversal vulnerability in the LocalStorage backend allows any authenticated user who can view an execution to read arbitrary files on the server. Before patching, the LocalStorage path validator mishandles Windows-style backslashes, letting an attacker smuggle tr...

GHSA-HJ85-PH9Q-78JG NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

Summary The shared form-view submit handler in NocoDB writes the form's redirecturl to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role or above on any base can plant a javascript: URL in the form's redirecturl; when an authenticated view...

Linux Distros Unpatched Vulnerability : CVE-2026-49128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Music Player Daemon MPD before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local...

CVE-2026-49128

Music Player Daemon MPD before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without...

CVE-2026-49128 Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling

Music Player Daemon MPD before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without...