68 matches found
CVE-2026-22198
GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting XSS vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value for example, to /api/v1/ticket.php, an unauthenticated attacker can cause...
CVE-2026-22198
GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting XSS vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value for example, to /api/v1/ticket.php, an unauthenticated attacker can cause...
CVE-2026-22198
GestSup prior to 3.2.60 (with sources also citing up to 3.2.56 in ENISA EUVD) contains a pre-authentication stored XSS in the API error logging. An unauthenticated attacker can craft the X-API-KEY header (e.g., to /api/v1/ticket.php) to inject HTML/JavaScript into log entries; when an administrat...
CVE-2022-23730
The public API error causes for the attacker to be able to bypass API access control...
GESTSUP 跨站脚本漏洞
GESTSUP is a software application from the French company GESTSUP. It is 100% web-based SUPport MANAGEMENT software that manages tickets and devices. A cross-site scripting vulnerability exists in GESTSUP 3.2.56 and prior versions, which stems from a flaw in the API error logging functionality th...
CVE-2026-22198: Improper Neutralization of Input During Web Page Generation
GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting XSS vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value for example, to /api/v1/ticket.php, an unauthenticated attacker can cause...
CVE-2025-13978 Generation of Error Message Containing Sensitive Information in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to discover the names of private projects they do not have access through API requests...
EUVD-2021-0155
Malware in sbrugna...
EUVD-2018-21590
Malware in sbrugna...
EUVD-2018-4271
Malware in sbrugna...
EUVD-2025-24963
Malicious code in bioql PyPI...
EUVD-2024-1313
Malicious code in bioql PyPI...
EUVD-2023-0851
Malicious code in bioql PyPI...
CVE-2025-8342
CVE-2025-8342 concerns the WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress. Affected versions up to 1.8.47 allow unauthenticated attackers to bypass OTP verification via faulty empty-value checks in lwp_ajax_register and exploit Firebase API error handling when the ...
Malicious code in web-api-error (npm)
The package web-api-error was found to contain malicious code...
MAL-2025-38964 Malicious code in web-api-error (npm)
The package web-api-error was found to contain malicious code...
CVE-2021-32561
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
CVE-2018-12297
Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names...
CVE-2025-46737 Origin Validation Error
SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing CORS configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected sources...
