42 matches found
CVE-2026-48539
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...
EUVD-2026-48298
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...
CVE-2026-48539 GFI Archiver < 15.13 Stored XSS via MailInsights.aspx
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...
CVE-2026-48539
GFI Archiver prior to 15.13 is affected by CVE-2026-48539: a stored XSS in the MailInsights.aspx report naming parameter. An authenticated user can inject script/HTML that is stored by ReportScheduling.btnSaveReport_Click() and later executes in the viewer’s browser when they access the MailInsig...
PT-2026-64015
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...
CVE-2026-48539: Improper Neutralization of Input During Web Page Generation
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...
EUVD-2024-16872
Malicious code in bioql PyPI...
CVE-2024-1097
A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...
CVE-2024-1097
A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...
CVE-2024-1097
A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...
CVE-2024-1097 Stored XSS in craigk5n/webcalendar
A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...
CVE-2024-1097 Stored XSS in craigk5n/webcalendar
A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...
CVE-2024-1097
CVE-2024-1097: A stored XSS in craigk5n/webcalendar 1.3.0 occurs in the Report Name input during report creation. Malicious scripts can run in other users’ context, potentially enabling theft of user accounts and cookies. Public details about a fix are not provided in the connected sources; no pa...
PT-2024-16673 · Craigk5N · Webcalendar
Name of the Vulnerable Software and Affected Versions: craigk5n/webcalendar version 1.3.0 Description: A stored cross-site scripting XSS issue exists in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of...
CVE-2024-1097: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...
Malicious code in report_name (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2023-24015
A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on...
Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2
Summary A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. Impact The reports section will be partially unavailable for all later attempts to use it, with the report list...
Acronis Cyber Protect Injection Vulnerability
Acronis Cyber Protect is an application. that provides unified protection for your network by integrating backup, disaster recovery, artificial intelligence-based malware protection, remote assistance and security into a single, reliable tool.Acronis Cyber Protect 15 Linux, Windows suffers from a...