CVE-2026-24900

An active vulnerability in MarkUs prior to version 2.9.1: the submissions/html_content endpoint accepts a select_file_id parameter that is not properly scoped to the requesting user, allowing access to arbitrary submission file contents by id. Impact is confidentiality (HIGH) without integrity/av...

CVE-2026-24900

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...

CVE-2026-24900 MarkUs has a submission-view IDOR exposes all student submissions

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...

MarkUs 安全漏洞

MarkUs is an open-source Ruby on Rails and React web application used for submitting and grading student assignments. Versions of MarkUs prior to 2.9.1 contained a security vulnerability due to insufficient file path checking, which could allow arbitrary file writing...

PT-2026-7131

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/html content accepted a select file id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not...

CVE-2026-24900: Authorization Bypass Through User-Controlled Key

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...

PT-2026-7132

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.1 Description MarkUs is a web application used for submitting and grading student assignments. Prior to version 2.9.1, instructors could upload a zip file to create an assignment from an exported configuration via...

CVE-2026-25057: Relative Path Traversal

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration courses//assignments/uploadconfigfiles. The uploaded zip file entry names are used to create paths to...

MarkUs 安全漏洞

MarkUs is an open-source Ruby on Rails and React web application used for submitting and grading student assignments. Version 2.9.1 of MarkUs contained a security vulnerability caused by improperly limited parameter ranges, which could allow access to arbitrary submission file contents...

CVE-2025-23868

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mliebelt Chess Tempo Viewer chesstempoviewer allows Stored XSS.This issue affects Chess Tempo Viewer: from n/a through = 0.9.5...

EUVD-2024-45366

Malicious code in bioql PyPI...

EUVD-2024-29948

Malicious code in bioql PyPI...

EUVD-2024-42700

Malicious code in bioql PyPI...

EUVD-2025-3489

Malicious code in bioql PyPI...

Malicious code in markus-oberlehner-net (npm)

The package markus-oberlehner-net was found to contain malicious code...

MAL-2025-25959 Malicious code in markus-oberlehner-net (npm)

The package markus-oberlehner-net was found to contain malicious code...

CVE-2024-51743

MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability in the update/upload/create file methods in Controllers allows authenticated instructors to write arbitrary files to any location on the web server...

CVE-2024-51499

MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability accessible via the updatefiles method of the SubmissionsController allows authenticated users e.g. students to write arbitrary files to any location...

CVE-2024-32127

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Markus Seyer Find Duplicates.This issue affects Find Duplicates: from n/a through 1.4.6...

CVE-2025-23868

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mliebelt Chess Tempo Viewer chesstempoviewer allows Stored XSS.This issue affects Chess Tempo Viewer: from n/a through = 0.9.5...