7614 matches found
CVE-2026-97635
The Agent Zero Web UI versions prior to 1.15 are vulnerable to Cross-Site Scripting (XSS) due to improper sanitization of user-provided input in chat messages and file uploads . When the application reproduces content in the chat interface, injected JavaScript executes within the context of the v...
CVE-2026-97635 Agent Zero Web UI XSS
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...
AgentZero XSS
RISK EVALUATION The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI...
cve-2022-33891
CVE-2022-33891 Apache Spark Shell Command Injection Vulnerability A Python POC for exploiting the Apache Spark Shell Command Injection vulnerability. I saw some other POCs out there but they looked mega sus. This one is clean and simple. I did not discover this exploit/vulnerability. I just wante...
EUVD-2026-105867
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM component: Web UI. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks require...
CVE-2026-101451
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM component: Web UI. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences. Successful attacks require...
CVE-2026-101451
A vulnerability exists in the Web UI component of Oracle Siebel CRM 's Siebel Life Sciences product, specifically affecting supported versions 17.0-26.9 . A low-privileged attacker with network access via HTTP can compromise the system, though the attack requires human interaction . Successful ex...
CVE-2026-4413
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2023-38375
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2023-38375
IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to cross-site scripting (XSS) (CWE-79). This flaw allows users to embed arbitrary JavaScript code within the Web UI, which can alter intended functionality and potentially lead to credentials disclosure during a trusted session. The...
EUVD-2023-60720
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2023-38375 IBM Cloud Pak System Cross-Site Scripting
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2026-4413 IBM Concert Software Cross-Site Scripting
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2026-4413
IBM Concert versions 1.0 through 3.0.0 are vulnerable to a cross-site scripting (XSS) flaw (CWE-79). This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code into the Web UI, which can alter the software's intended functionality. The practical impact includes the p...
EUVD-2026-104529
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2026-4413 IBM Concert Software Cross-Site Scripting
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2026-111883
Locust versions through 2.46.7 are vulnerable to a cross-site request forgery (CSRF) flaw within the Web UI. The issue allows remote attackers to perform unauthorized actions by luring an operator to a malicious page that triggers cross-site GET requests to the /stop and /stats/reset endpoints. S...
CVE-2026-111883 Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset
Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...
CVE-2026-111883 Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset
Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...
