11882 matches found
EUVD-2026-87204
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from before 1.43.10/1.45.5/1.46.1...
EUVD-2026-87112
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...
CVE-2026-96874 Stored XSS in Cargo Drilldown tab names
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...
CVE-2021-22204
CVE-2021-22204 - ExifTool Arbitrary Code Execution An upgraded proof-of-concept for CVE-2021-22204, a vulnerability in ExifTool versions 7.44 through 12.23 that allows arbitrary code execution when processing malicious DjVu files. Credit This is derivative work. The vulnerability and the original...
CVE-disclosures
CVE-2026-3171 y CVE-2026-3170 – Archana M Divulgaciones oficiales de vulnerabilidades por Archana M. 🔹 CVE-2026-3171 Producto: SourceCodester / Patrick Mvuma Patients Waiting Area Queue Management System 1.0 Tipo de vulnerabilidad: Cross-Site Scripting CWE-79 Archivo afectado: /queue.php Vector d...
CVE-2026-96744
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence...
EUVD-2026-86258
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence...
CVE-2022-29380
CVE-2022-29380 CVE-2022-29380 Fecha: 25/05/2022 Autor: OpenXP Team Software: Academy LMS Versión: Academy LMS = v4.3 Tipo: Cross-Site Scripting OWASP TOP 10: A03:2021-Injection CWE: CWE-79 Neutralización incorrecta de la entrada durante la generación de páginas web 'Cross-site Scripting'...
CVE-2026-81539
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to remote code execution. The flaw stems from the improper neutralization of special elements used in an OS command, which could allow a remote authenticated attacker to execute arbitrary code. No specific exploit details or remediation st...
CVE-2026-97182
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...
EUVD-2026-85859
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...
CVE-2026-97182 halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...
CVE-2026-97182
A security vulnerability exists in halo-dev Halo versions up to 2.25.4/2.26.1 . The flaw is located within an unknown function in the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java belonging to the SpEL Handler component. This issue leads to i...
CVE-2026-97322: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...
CVE-2026-6327
IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...
CVE-2026-19179 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression...
CVE-2026-19179
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a flaw where a remote attacker could manipulate database queries . This is caused by the improper neutralization of special elements within a boolean expression. The vulnerability allows for potential unauthorized impac...
CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...
EUVD-2026-84947
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command...