CVE-2026-118869

An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product...

CVE-2026-117679

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product...

CVE-2026-118869

An OS command injection vulnerability exists in SHIRASAGI . This flaw allows an authenticated attacker to execute arbitrary operating system commands on the system running the product. The vulnerability is associated with CWE-78 (Improper Neutralization of Special Elements used in an OS Command)....

EUVD-2026-117397

An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product...

CVE-2026-118869

An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product...

CVE-2026-117679

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product...

EUVD-2026-117398

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product...

CVE-2026-117679

A cross-site scripting (XSS) vulnerability exists in SHIRASAGI . This flaw may allow an authenticated attacker to execute arbitrary scripts within a user's web browser when the user visits a website using the affected product. The vulnerability is associated with CWE-79 (Improper Neutralization o...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

CVE-2026-81635

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

Multiple vulnerabilities in SHIRASAGI

Overview SHIRASAGI provided by SHIRASAGI Project contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2026-81635 Authorization bypass CWE-639 - CVE-2026-82582 CVE-2026-81635 Tonosaki Aoba of Tokyo Denki University remote control Laboratory reported this vulnerability ...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

CVE-2026-82582

An authorization bypass vulnerability in SHIRASAGI groupware allows an attacker with low privileges to retrieve files from the shared file feature by manipulating a user-controlled key. The root cause is the reliance on a user-supplied key for access control in the shared file module, enabling un...

EUVD-2026-75272

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

CVE-2026-81635

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

CVE-2026-81635

SHIRASAGI by Security Science is affected by a cross-site scripting (XSS) vulnerability that may allow an attacker to execute arbitrary script in the web browser of a user who accesses a website using the product. The CNA (JPCERT) assigns a MEDIUM severity (CVSS 3.0 base score 5.4; CVSS 4.0 base ...

EUVD-2026-75271

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

CVE-2026-81635

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

CVE-2026-82582: Authorization Bypass Through User-Controlled Key

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...