2284 matches found
Rukovoditel <= 3.2.1 - Cross Site Scripting
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add Announcement function at /index.php?module=helppages/pages&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...
CVE-2026-104612
The SourceCodester Student Result Management System 1.0 contains a Cross-Site Scripting (XSS) vulnerability within the Announcement Module . The flaw is located in the script/academic/core/new_announcement.php file, where the manipulation of the title/announcement argument allows for remote execu...
EUVD-2026-91626
A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/newannouncement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is...
CVE-2026-90407
A flaw was found in the Linux kernel's ath11k Wi-Fi driver. This vulnerability arises from insufficient validation of firmware input, specifically the numvdevs field, which is used as a loop bound without proper size checks. An attacker could exploit this to trigger an out-of-bounds read,...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies. In some configurations, due to improper sanitisation, specially...
kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
A flaw was found in the Bluetooth subsystem of the Linux kernel, specifically within the hcisync component. This vulnerability occurs when the hciadvbcastannoucement function attempts to prepend Broadcast Announcement service data to an existing advertising payload that is already at its maximum...
CVE-2023-24284
Portable Puzzle Collection (sgt-puzzles) versions before 20230116.5782e29 contain a buffer overflow in the Guess puzzle , triggered via the is_markable() function when processing a crafted save file . The vulnerability was fixed upstream in commit 5279fd2, but Ubuntu reports no vendor-supplied pa...
CVE-2023-45023
femanager (version 7, before 7.2.2 ) is a TYPO3 extension used for frontend user account management. The vulnerability stems from a missing permission check in the invitation component , allowing a remote user with low privileges to create frontend user accounts with access to configured frontend...
CVE-2023-50462
The Content Consent (content_consent) extension for TYPO3 , versions through 2.0.1 , suffers from an Insecure Direct Object Reference (IDOR) . The plugin fails to verify whether a specified content element identifier is permitted, allowing an unauthenticated user to display various content elemen...
CVE-2023-46035
CVE-2023-46035 affects the svg_optimizer Ruby gem (versions before 0.3.0 , specifically v0.2.6), an SVG optimization library based on Node's SVGO. The vulnerability is an XML External Entity (XXE) injection caused by allowing entity expansion by default when parsing untrusted SVG documents. A rem...
CVE-2026-71802
A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...
CVE-2026-71802: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...
CVE-2026-71802
A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...
CVE-2026-71802
A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...
PT-2026-89151
A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...
EUVD-2026-75161
A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...
CVE-2026-71802
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3 . While the server performs HTML escaping on announcement content, the client-side preview code uses jQuery's html().text() method to reverse those escapes before injecting the result i...
kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
A flaw was found in the Bluetooth subsystem of the Linux kernel, specifically within the hcisync component. This vulnerability occurs when the hciadvbcastannoucement function attempts to prepend Broadcast Announcement service data to an existing advertising payload that is already at its maximum...
