CVE-2026-97322 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

EUVD-2026-86398

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97322 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97322

A cross-site scripting (XSS) vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (versions up to 2026.08). The flaw affects an unspecified function within the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileControll...

CVE-2026-13249 Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...

CVE-2026-13249

The Honeywell PD45 Industrial Printer (version F10.19.010040 ) is vulnerable to an unauthenticated Remote Code Execution (RCE) via Arbitrary File Upload in its web management interface. This flaw allows an attacker to upload and execute malicious files or commands without any authentication. To r...

CVE-2026-13249 Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...

EUVD-2026-86350

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...

CVE-2026-91133

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

EUVD-2026-86306

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-91121

The Discourse open-source discussion platform is vulnerable to trusted-HTML injection in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . The root cause is that attacker-controlled upload filenames used in chat message excerpts are rendered as unescaped HTML . An attacker capable of...

CVE-2026-91133

The open-source discussion platform Discourse is vulnerable to an information disclosure flaw in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . Authenticated users can provide unescaped SQL LIKE metacharacters in upload-resolution patterns. This allows wildcard input to select unr...

EUVD-2026-86299

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

CVE-2026-91133 Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

CVE-2026-91133 Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

CVE-2026-97359

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

CVE-2026-97062

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...