CVE-2026-58475

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...

CVE-2026-58475 Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...

CVE-2026-58475

CVE-2026-58475 affects Sustainable Irrigation Platform (SIP) v5.2.16, where an attacker can store arbitrary JavaScript in program names via HTTP requests due to lack of output encoding. This stored XSS can render in browsers of any user viewing affected pages. Exploitation details from the ZerOSc...

EUVD-2023-1121

Malicious code in bioql PyPI...

MAL-2025-41498 Malicious code in @twork-data-services/loyalty-program-names (npm)

--- -= Per source details. Do not edit below this line.=-...

HackerOne: Hackerone All Private Program Name Leaked to Public Via Collaborator OR Attacker can Easily Dump all Private Program Names through Collaborator

A vulnerability was discovered in Hackerone that allowed an attacker to obtain the names of private programs. By manipulating the report ID and using the Collaborator feature, the attacker could determine if a program was private or public. This compromised the confidentiality of private programs...

Interactive `run` permission prompt spoofing via improper ANSI neutralization

Summary Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a opspawnchild or opkill prompt and replace it with any desired text. Details The main entry point comes down to the ability to override what the API control says 40process.js...

Citrix MetaFrame ICA Published Applications Bruteforcer

This module attempts to brute force program names within the Citrix Metaframe ICA server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Citrix MetaFrame ICA Published Applications Bruteforcer...