CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

EUVD-2026-31307

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id and ticketid GET parameters directly into an HTML form action URL. Attackers can...

CVE-2026-4858 Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action...

CVE-2025-14040

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Call to Action' custom fields in all versions up to, and including, 13.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in th...

CVE-2025-20920

Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory...

CVE-2025-20920: Out-of-bounds Read

Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory...

CVE-2024-5024

CVE-2024-5024 concerns the MemberPress WordPress plugin. The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw that can be triggered via the mepr_screenname and mepr_key parameters in pages that trigger user actions. It affects all versions up to and including 1.11.29 (per the initial ...

NeoMind Fusion Platform 跨站脚本漏洞

NeoMind Fusion Platform is an Artificial Intelligence AI solution designed to provide intelligent diagnosis, treatment, and assisted decision support in the healthcare field. A cross-site scripting vulnerability exists in NeoMind Fusion Platform, which stems from the parameter link in the file...

SUSE CVE-2020-9359

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

Vulnerability of the actionLinkHandler method in the server-based corporate messaging system that supports file sharing and video conferences. Chat, which allows attackers to expose sensitive information.

The vulnerability of the actionLinkHandler method in the server-based corporate messaging system that supports file and video conferencing exchanges. Chat-related vulnerabilities involve insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to disclose...

PT-2022-4943 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Rocket.Chat versions prior to 4.8.2 Rocket.Chat versions prior to 4.7.5 Description: An information disclosure issue exists due to insufficient input validation in the actionLinkHandler method, allowing Message...

okular: local binary execution via specially crafted PDF files

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

DEBIAN-CVE-2020-9359

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

CVE-2020-9359

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

CVE-2020-9359

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

UBUNTU-CVE-2020-9359

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

CVE-2020-9359

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

CVE-2020-9359

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

CVE-2020-9359: Undefined Security Weakness

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...

JTBC (PHP) File Deletion Vulnerability

JTBC PHP is an open source CMS Content Management System. JTBC PHP 3.0.1.6 version of the file deletion vulnerability , a remote attacker can use /console/file/manage.php?type=action&action=delete&path=c%3A%2F URL to exploit the vulnerability to delete arbitrary files on the system...