CVE-2026-75514

In BunkerWeb versions prior to 1.6.13, the blacklist, greylist, and antibot modules in blacklist.lua, greylist.lua, and antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without calling get_ips to verify the hostname resolves to the client IP. An attacker...

EUVD-2026-63542

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORERDNS,...

CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

EUVD-2026-58731

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 is affected by an authenticated reflected XSS in the HTML editor popup endpoint. The vulnerability arises because the text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding, enabling ...

PT-2026-76555

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...

CVE-2026-28003

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

CVE-2026-28003

The CVE-2026-28003 entry describes an unauthenticated Cross Site Scripting (XSS) vulnerability in WordPress Maspik – Spam blacklist plugin, affecting versions up to 2.9.1. The issue is documented with CVSSv3.1 base score 7.1 (HIGH) with NETWORK attack vector, no privileges required, user interact...

EUVD-2026-57942

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

PT-2026-71508

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

CVE-2026-71232

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...

EUVD-2026-53305

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog. Combined...

CVE-2026-71232

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog. Combined...

CVE-2026-71232 MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...