Netsweeper 4.0.5 - Default Weak Account

The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...

CVE-2020-8825

CVE-2020-8825 Publish: CVE-2020-8825 Vendor: PHP VanillaForum Description: The vulnerability exists due to insufficient sanitization of user-supplied data passed to "index.php?p=/dashboard/settings/branding" URL. A remote attacker can permanently inject and execute arbitrary HTML and script code ...

CVE-2022-32060

Snipe-IT Version v6.0.2 Vulnerability Explanation: An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file. Attack Vectors: We found a vulnerability file upload, when we upload malicious file...

CVE-2025-68428_PoC

CVE-2025-68428PoC $ git clone https://github.com/12nio/CVE-2025-68428PoC/ && cd CVE-2025-68428PoC $ sudo docker build -t poc . $ sudo docker run --rm -p 8080:8080 --name vuln poc $ curl "http://127.0.0.1:8080/api/v1/generate-invoice?client=Dinko&branding=../secret" --output poc.pdf...

CVE-2026-79363

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

EUVD-2026-95789

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

CVE-2026-79363

Cloudron versions 9.1.7 and 9.2 are susceptible to a stored cross-site scripting (XSS) vulnerability within the Branding Footer feature. An authenticated administrator can exploit this by storing crafted HTML containing JavaScript event handlers in the Footer setting. Because the application fail...

CVE-2026-79363

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

PT-2026-108911

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

Fake Microsoft security scans trick victims into uninstalling their antivirus

A wave of websites is offering to check whether your antivirus is working. They call themselves SysScan , carry Microsoft branding, and all reach the same conclusion: Your computer has serious problems, and the cause is the antivirus software you installed. Windows, they claim, no longer supports...

GHSA-V7CF-8GH9-GXMJ Winter: Stored XSS through Brand Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...

Winter: Stored XSS through Brand Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the custom styles process. An attacker can execute arbitrary scripts in the context of backend users by injecting malicious CSS that is not properly sanitized. This is only exploitable if the attacker has the...

PT-2026-76552

Name of the Vulnerable Software and Affected Versions Winter versions prior to 1.2.13 Description Custom CSS provided through the Brand Settings Styles field is compiled by the LESS parser and rendered without sanitization on every backend page. This allows a user with the backend.manage branding...

Malicious code in @vertexa/prisma-fetch-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled ' @prisma/fetch-engine', author 'Tim Suchanek ...

Malicious code in cdktn-provider-azurerm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...

CVE-2026-5062: Improper Neutralization of Special Elements used in an SQL Command

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

gio-branding-upstream-2.88.3-1.1 on GA media (moderate)

gio-branding-upstream-2.88.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11415-1 Rating: moderate Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2026-15588 SUSE : 4.8...

OPENSUSE-SU-2026:11415-1 gio-branding-upstream-2.88.3-1.1 on GA media

These are all security issues fixed in the gio-branding-upstream-2.88.3-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-34530

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting XSS via admin-controlled branding fields. An admin who...