6 matches found
CVE-2026-110627
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...
CVE-2026-110627
ClipBucket versions v5 through 5.5.3-#206 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the admin_area/index.php component. The root cause is the improper neutralization of input in the val parameter when mode=add_todo is used. An attacker can leverage this to inje...
EUVD-2026-101255
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...
CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...
CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...
CVE-2025-13545: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an unknown functionality of the file /adminarea/index.php. The manipulation of the argument editpack leads to sql injection. The attack can be...