Lucene search
+L

89687 matches found

Positive Technologies
Positive Technologies
added 3 days ago9 views

PT-2026-66834

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant url value containing a dangerous URI scheme. T...

7.3CVSS5.3AI score0.00282EPSS
SaveExploits0References1
EUVD
EUVD
added 3 days ago10 views

EUVD-2025-210575

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

5.8AI score0.00156EPSS
SaveExploits0References3
CVE
CVE
added 3 days ago9 views

CVE-2025-69948

CVE-2025-69948 affects SourceCodester Modern Loan Management System 1.0. The vulnerability is a SQL Injection in the parameter id of the script /admin/delete_group.php?id=1. The connected sources (NVD and CVE records) confirm the presence of this injection flaw but do not provide details on affec...

5.8AI score0.00156EPSS
SaveExploits0References3
NVD
NVD
added 4 days ago6 views

CVE-2026-66420

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

8.8CVSS0.00165EPSS
SaveExploits0References4
NVD
NVD
added 4 days ago6 views

CVE-2026-66421

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...

9.3CVSS0.00363EPSS
SaveExploits0References3
CVE
CVE
added 4 days ago20 views

CVE-2026-66421

The CVE-2026-66421 entry documents a stored cross-site scripting vulnerability in OpenClaw Dashboard. The issue arises from processing agent transcript messages via the sessions API, where attacker-supplied HTML markup (for example, an inline event handler in an img tag) can be stored in a sessio...

9.3CVSS6.1AI score0.00363EPSS
SaveExploits0References3
OSV
OSV
added 4 days ago5 views

CVE-2026-66421 OpenClaw Dashboard Stored XSS via lastMessage Session Field

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...

8.8CVSS5.7AI score0.00363EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 4 days ago6 views

CVE-2026-66420

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

8.8CVSS6AI score0.00165EPSS
SaveExploits0References5Affected Software1
NVD
NVD
added 4 days ago10 views

CVE-2026-66418

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

9.3CVSS0.00338EPSS
SaveExploits0References3
NVD
NVD
added 4 days ago10 views

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

9.1CVSS0.00303EPSS
SaveExploits0References2
NVD
NVD
added 4 days ago8 views

CVE-2025-65341

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...

6.1CVSS0.00149EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-66418 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

9.3CVSS0.00338EPSS
SaveExploits0References3
EUVD
EUVD
added 4 days ago11 views

EUVD-2026-51309

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

9.3CVSS6AI score0.00338EPSS
SaveExploits0References3
CVE
CVE
added 4 days ago23 views

CVE-2026-66418

OpenClaw Dashboard v3.0.0 is affected by a stored XSS in the login failure path. An unauthenticated attacker can submit a crafted username, which is recorded in the audit log and later rendered unescaped via innerHTML in the administrator notification panel. The permissive CSP (allowing inline ev...

9.3CVSS6AI score0.00338EPSS
SaveExploits0References3
NVD
NVD
added 4 days ago8 views

CVE-2026-67528

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/customoptions/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visiblecurrentuser, so authenticated non-admin users could...

4.3CVSS0.0021EPSS
SaveExploits0References3
NVD
NVD
added 4 days ago8 views

CVE-2026-65835

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...

6.6CVSS0.00192EPSS
SaveExploits0References2
Cvelist
Cvelist
added 4 days ago32 views

CVE-2026-65835 Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...

6.6CVSS0.00192EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 4 days ago8 views

CVE-2026-65835

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...

6.6CVSS5.9AI score0.00192EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD
added 4 days ago12 views

EUVD-2026-51293

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

8.8CVSS5.9AI score0.003EPSS
SaveExploits0References2
CVE
CVE
added 4 days ago26 views

CVE-2026-67207

CVE-2026-67207 affects Wolf CMS up to version 0.8.3.1. The vulnerability is an authorization bypass in the BackupRestoreController caused by a PHP operator precedence flaw in the permission check expression. This allows authenticated non-administrative users to access restricted backup functional...

8.8CVSS5.9AI score0.003EPSS
SaveExploits0References2
Rows per page
Query Builder