PT-2026-68954

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g3hp-vvqf-8vw6. This link is maintained to preserve external references. Original Description Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page...

CVE-2026-56381: Improper Neutralization of Input During Web Page Generation

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other...

PT-2026-26934

Summary A stored XSS vulnerability exists in the User Permissions page. The User Group name is rendered without proper HTML escaping in the permissions section, allowing an attacker to execute arbitrary JavaScript when another user views or edits a user's permissions. !NOTE This is a separate...

EUVD-2022-1667

Malicious code in bioql PyPI...

Rapid7 Insight Platform security vulnerabilities

Rapid7 Insight Platform is a platform for managing profiles, users, products, API keys, and settings from Rapid7 USA. A security vulnerability exists in Rapid7 Insight Platform that stems from the inclusion of an authorization missing issue that allows an attacker to intercept local requests to s...

CVE-2018-1551

IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name. IBM X-Force ID: 142888...

PT-2018-13062

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ versions 8.0.0.2 through 8.0.0.8 IBM WebSphere MQ versions 9.0.0.0 through 9.0.0.3 Description The issue allows users to have more authority than they should have if an MQ administrator creates an invalid user group name...

CVE-2018-1551: Incorrect Permission Assignment for Critical Resource

IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name. IBM X-Force ID: 142888...

CVE-2018-8832

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...

CVE-2018-8832

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...

CVE-2018-8832: Improper Neutralization of Input During Web Page Generation

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...

PT-2018-18650

Name of the Vulnerable Software and Affected Versions enhavo version 0.4.0 Description The issue allows for a cross-site scripting XSS attack via a user-group that contains executable JavaScript code in the user-group name. This attack is launched when a victim visits the "admin user group" page...

MODX Revolution CMS Cross-Site Scripting Vulnerability

MODX Revolution CMS is a new generation of Web2.0 open source content management system CMS of the U.S. company MODX. The system supports online collaboration , search engine optimization SEO, add-ons and so on. A cross-site scripting vulnerability exists in MODX Revolution CMS 2.5.6 and earlier...

CVE-2017-1000223

A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...

PT-2017-10919

Name of the Vulnerable Software and Affected Versions MODX Revolution CMS versions 2.5.6 and earlier Description A stored web content injection issue is present, allowing an authenticated user with permissions to edit users to save malicious JavaScript as a User Group name. This could potentially...

CVE-2017-1000223: Improper Neutralization of Input During Web Page Generation

A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...