5378 matches found
PT-2026-84382
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Incorrect authorization allows a user with workflow edit permissions to achieve privilege escalation. By exploiting incorrectly configured access control security levels, an attacker can cause...
CVE-2026-51691
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-40464
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
EUVD-2026-68373
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
CVE-2026-40464 A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
CVE-2026-40464
Nokia NSP contains a stored XSS vulnerability in its workflow application , caused by insufficient validation or encoding of user-controlled input. An authenticated attacker with access to the workflow application can embed malicious code that executes in another user's browser when they view the...
PT-2026-83852
Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUploadSetting function allows unauthenticated attackers to manipulate the upload or flash workflow. This is achieved by sending a crafted POST request to...
EUVD-2026-68586
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51691
CVE-2026-51691 is a critical (CVSS 9.8) incorrect access control vulnerability in the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . The flaw resides in the setUploadSetting function, which is reachable via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated network a...
Exploit for Code Injection in Gitea
🫖 CVE-2026-60004 Gitea Validator A standalone discovery, as...
CVE-2026-82486
A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Performing a manipulation of the argument SecurityKey results in improper access controls. Remote exploitation of the attack is possible. The...
EUVD-2026-68176
A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Performing a manipulation of the argument SecurityKey results in improper access controls. Remote exploitation of the attack is possible. The...
CVE-2026-82486
A vulnerability in SiteServer SSCMS 7.4.0 affects the Agent Installation Workflow component, where improper access controls are triggered by manipulating the SecurityKey argument. The attack is remotely exploitable but rated as high complexity and difficult to execute . CVSS 3.1 scores it 5.0 (Me...
EUVD-2026-68138
A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be...
CVE-2026-82423
A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be...
CVE-2026-82423 macrozheng mall Payment Status Endpoint paySuccess behavioral workflow
A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be...
CVE-2026-82423 macrozheng mall Payment Status Endpoint paySuccess behavioral workflow
A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be...
CVE-2026-82423
A behavioral workflow enforcement vulnerability exists in the macrozheng mall project (up to version 1.0.3 ). The issue affects the Payment Status Endpoint at the file /order/paySuccess, where manipulation of the orderId argument allows a remote, low-privilege attacker to enforce a behavioral wor...
CVE-2026-82475
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitio...
CVE-2026-82475 iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitio...