CVE-2026-24746

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at th...

CVE-2026-24746

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at th...

CVE-2026-24746

InvoicePlane 1.7.0 contains a Stored Cross‑Site Scripting (XSS) flaw in the Edit Quotes workflow (quote_number input) that is exploitable with administrator privileges. The issue can lead to unauthorized data modification and persistence of malicious scripts, potentially compromising application ...

CVE-2026-24746 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at th...

CVE-2026-24746 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at th...

CVE-2026-24746 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at th...

PT-2026-20507

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.0 Description InvoicePlane is a self-hosted open source application used for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS issue exists in the Edit Quotes function. The application does no...

OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

Summary Exec approvals allowlist bypass via command substitution/backticks inside double quotes. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.2.2 Impact Only affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are...

GHSA-3HCM-GGVF-RCH5 OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

Summary Exec approvals allowlist bypass via command substitution/backticks inside double quotes. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.2.2 Impact Only affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are...

Command Injection

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Command Injection via the exec approvals allowlist when command substitution or backticks are used inside double quotes. An attacker can execute arbitrary commands by bypassing the intend...

ImapEngine 安全漏洞

ImapEngine is an email management interface developed by DirectoryTree. Versions of ImapEngine prior to 1.22.3 contained security vulnerabilities. These vulnerabilities stemmed from the id function in ImapConnection.php, which had improper handling of user input. This could allow attackers to rea...

NETGATE Data Backup 代码问题漏洞

NETGATE Data Backup is a data backup software developed by the Slovak company NETGATE. Version NETGATE Data Backup 3.0.620 contains a code vulnerability. This vulnerability stems from the service path in the configuration of the NGDatBckpSrv Windows service, which lacks quotation marks. This coul...

Flexense Disk Savvy Enterprise 代码问题漏洞

Flexense Disk Savvy Enterprise is a hard drive space analysis tool provided by Flexense Corporation. Version 12.3.18 of Flexense Disk Savvy Enterprise contains a code vulnerability. This vulnerability stems from a service path vulnerability in service configurations that lacks quotes. Attackers c...

The vulnerability of the EMP_NSWLSV service, a utility for IP-networked content transmission in EasyMP Network Projection, allows an attacker to escalate their privileges and execute arbitrary code.

The vulnerability of the EMPNSWLSV service, a utility for IP-networked content transmission via EasyMP Network Projection, stems from the lack of quotation marks in the code for elements or search paths. Exploiting this vulnerability can allow attackers to enhance their privileges and execute...

Veritas NetBackup 代码问题漏洞

Veritas NetBackup is a powerful enterprise-level data backup management software developed by Veritas Corporation in the United States. Version 7.0 of Veritas NetBackup contains a code vulnerability. This vulnerability stems from the lack of quotation marks around the NetBackup INET Daemon servic...

CVE-2020-37008

CVE-2020-37008 affects EasyPMS 1.0.0. The vulnerability is an authentication bypass that lets unprivileged users manipulate SQL queries in JSON requests by injecting single quotes in ID parameters, allowing access to admin user information and potential modification of admin passwords without pro...

Nord VPN code-related vulnerabilities

Nord VPN is a proxy software developed by the Nord VPN company. Version 6.31.13.0 of Nord VPN contains a code vulnerability. This vulnerability stems from the lack of quotation marks around the nordvpn-service service path, which may allow local attackers to execute code with elevated privileges...

Gear Box Computers IP Watcher code issues and vulnerabilities

Gear Box Computers IP Watcher is a network monitoring tool developed by Gear Box Computers. Version 3.0.0.30 of Gear Box Computers IP Watcher has a code vulnerability; this vulnerability stems from Windows service configurations that include service paths without quotes, which may allow arbitrary...

EUVD-2026-4661

dcap-qvl implements the quote verification logic for DCAP Data Center Attestation Primitives. A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity,...

CVE-2026-22696 dcap-qvl has Missing Verification for QE Identity

dcap-qvl implements the quote verification logic for DCAP Data Center Attestation Primitives. A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity,...