CVE-2026-54596

CVE-2026-54596 - Inyección SQL autenticada a través del parámetro recurringinvoicefrequency permite la exfiltración completa de la base de datos Severidad: Alta Aviso: GHSA-f9m3-qjc9-v27j Corregido en: Commit 7211426 Autor: iltosec Resumen Una vulnerabilidad de inyección SQL en el endpoint de...

EUVD-2026-88598

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject...

CVE-2026-102374 GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject...

CVE-2026-102374: Improper Neutralization of Input During Web Page Generation

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject...

CVE-2026-55214

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version...

EUVD-2026-87283

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version...

CVE-2026-55214 GLPI: Stored XSS in suppliers

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version...

CVE-2026-55214

The asset and IT management software GLPI versions 11.0.6 through 11.0.8 are vulnerable to a stored cross-site scripting (XSS) flaw. An authenticated technician can exploit this by storing active markup within the supplier website fields . When any user subsequently views the affected item's supp...

CVE-2026-55214 GLPI: Stored XSS in suppliers

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version...

PT-2026-99075

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.6 through 11.0.7 Description An authenticated technician can store active markup in supplier website fields. This leads to stored cross-site scripting XSS, where any user viewing the affected item's suppliers list triggers t...

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

CVE-2026-48786

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

SimpleHelp 5.5.x < 5.5.16 OIDC Authentication Bypass

The version of SimpleHelp running on the remote web server is 5.5.x prior to 5.5.16 or a 6.0 pre-release prior to 6.0 RC2. It is, therefore, affected by an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during...

Xerox Printers Loop with Unreachable Exit Condition (CVE-2022-23968)

Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as so...

Exploit for Improper Verification of Cryptographic Signature in Simple-Help Simplehelp

CVE-2026-48558: SimpleHelp OIDC Authentication Bypass !WAR...

Exploit for CVE-2026-54596

CVE-2026-54596 - Authenticated SQL Injection via recurringinv...

EUVD-2026-36509

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a...

CVE-2026-48558

Summary of vulnerability (CVE-2026-48558) : SimpleHelp versions 5.5.15 and earlier and 6.0 pre-release contain an authentication bypass in the OpenID Connect (OIDC) flow. When OIDC is configured, identity tokens are accepted without cryptographic signature verification, allowing a remote, unauthe...

PT-2026-48947

Name of the Vulnerable Software and Affected Versions SimpleHelp versions prior to 5.5.16 SimpleHelp versions prior to 6.0 RC2 Description An authentication bypass exists in the OpenID Connect OIDC authentication flow. The software fails to verify the cryptographic signature of identity tokens...

CVE-2026-42317

Product: GLPIVulnerability: Arbitrary files deletion by a technicianAffected versions: from 0.78 up to, but not including, 10.0.25 and 11.0.7Root cause/condition: Webserver must have write rights on the target files; a logged-in technician can delete arbitrary files from the filesystemImpact (as ...