20170 matches found
CVE-2026-70427
creationtimestamp| type| source ---|---|--- 2026-08-06 12:45:26+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-nuove-vulnerabilita-in-jenkins-2...
CVE-2026-20288
creationtimestamp| type| source ---|---|--- 2026-08-06 12:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-cisco-29 2026-08-06 13:10:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msg4htwlvh2m...
CVE-2026-8166
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...
CVE-2026-8166
CVE-2026-8166 describes a Stored XSS vulnerability in Logo Software Industry and Trade Inc.’s e-Logo Purchasing Portal , exploitable by inserting malicious input that is not properly neutralized during web page generation. The issue affects the portal before version 1.52. The underlying cause is ...
CVE-2026-8166 Stored XSS in Logo Software's e-Logo Purchasing Portal
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...
EUVD-2026-53866
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...
CVE-2026-71251
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
CVE-2026-71233
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...
EUVD-2026-53324
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
CVE-2026-71251
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
CVE-2026-71251
CVE-2026-71251 (Akaunting) : The shared download route app/Http/Controllers/Common/Uploads.php::download() allowed an authenticated portal customer to fetch any Media by ID without verifying ownership. This constitutes a cross-company IDOR: a user could download another company’s uploaded files b...
EUVD-2026-53306
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! $entity-terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from th...
CVE-2026-71233 InvoiceNinja - Stored XSS via Invoice/Quote Terms Field
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...
EUVD-2026-52965
Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...
CVE-2026-51144
Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...
CVE-2026-58071
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...