12201 matches found
CVE-2026-64967: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process. Product is...
CVE-2026-40509
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...
CVE-2026-40509 OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...
CVE-2026-40509
OpenEMR before 8.3.0 is affected by a cross-site request forgery (CSRF) vulnerability in the DICOM viewer . The web_path GET parameter is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a malicious URL that causes an authenticated user holding...
CVE-2026-40509 OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...
EUVD-2026-62510
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...
CVE-2026-40509 OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab's image viewer allows for cross-site scripting XSS when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution RCE on the JupyterLab server. ImpactThis vulnerability allows for arbitrary...
PYSEC-2026-3671 JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab's image viewer allows for cross-site scripting XSS when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution RCE on the JupyterLab server. Impact This vulnerability allows for arbitrary...
PT-2026-78468
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0 Description A cross-site request forgery issue exists in the DICOM viewer. The web path GET parameter in the DICOM viewer page is embedded as a URL without proper sanitization or validation against expected path...
CVE-2026-40509: Cross-Site Request Forgery (CSRF)
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...
CVE-2026-32473
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
EUVD-2026-60815
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery = 1.16.20 versions...
CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32473
The "pdf-smart-viewer-for-elementor" WordPress plugin (versions ≤ 1.0.4) allows unauthenticated attackers to force server-side HTTP requests, enabling internal network access or metadata probing. CVSS 7.2 (HIGH) reflects network access with low impact. No exploitation observed; update to a patche...
EUVD-2026-60907
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32473
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin PDF Smart Viewer for Elementor versions = 1.0.4...