18 matches found
EUVD-2026-42992
Snipe-IT vulnerable to stored XSS via Markdown custom field...
CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScrip...
CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScrip...
CVE-2026-55464
Snipe-IT (IT asset/license management) is affected by CVE-2026-55464 prior to version 8.6.2. The issue arises from CommonMark escaping raw HTML but not sanitizing javascript: URIs in Markdown hyperlinks within a markdown-textarea custom field. A user with assets.edit permission can insert a malic...
CVE-2026-33158
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized...
CVE-2026-33158
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized...
CVE-2026-33158 Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized...
PT-2026-27463
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized...
CVE-2026-33158: Authorization Bypass Through User-Controlled Key
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized...
CVE-2025-11656
A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function of the file /assets/editNotes.php. Executing manipulation of the argument File can lead to unrestricted upload. The attack can be launche...
PT-2018-15162
Name of the Vulnerable Software and Affected Versions DomainMOD versions prior to 4.11.02 Description The issue allows for XSS attacks via the assets/edit/host.php Web Host Name or Web Host URL field. Recommendations For DomainMOD versions prior to 4.11.02, update to version 4.11.02 or later to...
CVE-2018-19915: Improper Neutralization of Input During Web Page Generation
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field...
CVE-2018-19136
DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter...
CVE-2018-19137: Improper Neutralization of Input During Web Page Generation
DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...
PT-2018-14828
Name of the Vulnerable Software and Affected Versions DomainMOD versions prior to 4.11.02 Description The issue allows for XSS via the ipid parameter in the "assets/edit/ip-address.php" endpoint. Recommendations For DomainMOD versions prior to 4.11.02, update to version 4.11.02 or later to resolv...
Design/Logic Flaw
DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter...