19904 matches found
CVE-2026-16881
The LINE Android app (before 26.7.2) contains a vulnerability in the profile rendering component where externally supplied script content embedded in profile templates is not adequately validated or sandboxed. This can allow crafted profile content to execute arbitrary code with the app’s privile...
ATutor < 2.2.1 - Cross Site Scripting
ATutor 2.2.1 was discovered with a vulnerability, a reflected cross-site scripting XSS, in ATtutor 2.2.1 via token body parameter. id: CVE-2023-27008 info: name: ATutor 2.2.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | ATutor 2.2.1 was discovered with a vulnerability, a...
Emlog Pro v2.1.14 - Cross-Site Scripting
Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. id: CVE-2023-41621 info: name: Emlog Pro v2.1.14 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. impact: ...
DomainMOD 4.11.01 - Cross-Site Scripting
DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...
GRAND FlAGallery 1.57 - Cross-Site Scripting
A cross-site scripting XSS vulnerability in facebook.php in the GRAND FlAGallery plugin flash-album-gallery before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter. id: CVE-2011-4624 info: name: GRAND FlAGallery 1.57 - Cross-Site Scripting...
OURPHP <= 7.2.0 - Cross Site Scripting
OURPHP alertdocument.domain" matchers-condition: and matchers: - type: word part: body words: - "alertdocument.domain...
kkFileView 4.1.0 - Cross-Site Scripting
kkFileView 4.1.0 is susceptible to cross-site scripting via the url parameter at /controller/OnlinePreviewController.java. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...
Piwigo 13.7.0 - SQL Injection
Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header User-Agent is vulnerable at the endpoint that records user information when logging in to the...
Doctor Appointment System 1.0 - SQL Injection
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter. id: CVE-2021-27320 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind S...
CVE-2026-17614
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...
CVE-2026-42169
A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...
NPM: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
NPM: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.18...
EUVD-2026-52370
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...
CVE-2026-69152
Brace-expansion library vulnerability CVE-2026-69152: expand() mishandles maxLength for intermediate arrays and padded sequences, enabling memory exhaustion or event-loop stalls via attacker-controlled input. Affected versions: <1.1.18, <2.1.4, <3.0.6,
CVE-2026-57432
A flaw was found in Perl. An integer overflow vulnerability in the Smeasurestruct function, specifically when handling pack and unpack templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive...
CVE-2026-18651
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...
firefox: thunderbird: Mitigation bypass in the Enterprise Policies component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Enterprise Policies component...
firefox: thunderbird: Mitigation bypass in the DOM: Networking component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Networking component...
firefox: thunderbird: Mitigation bypass in the PDF Viewer component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the PDF Viewer component...
firefox: thunderbird: Mitigation bypass in the PDF Viewer component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the PDF Viewer component...