312 matches found
CVE-2022-32060
Snipe-IT Versión v6.0.2 Explicación de la vulnerabilidad: Una vulnerabilidad de carga arbitraria de archivos en el componente de Actualización de Configuración de Marca de Snipe-IT v6.0.2 permite a los atacantes ejecutar código arbitrario a través de un archivo manipulado. Vectores de ataque:...
CVE-2020-8825
CVE-2020-8825 Publicación: CVE-2020-8825 Proveedor: root@kitploit: PHP VanillaForum Descripción: root@kitploit: La vulnerabilidad existe debido a una sanitización insuficiente de los datos proporcionados por el usuario enviados a la URL "index.php?p=/dashboard/settings/branding". Un atacante remo...
Netsweeper 4.0.5 - Default Weak Account
The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...
CVE-2025-68428_PoC
CVE-2025-68428PoC root@kitploit: $ git clone https://github.com/12nio/CVE-2025-68428PoC/ && cd CVE-2025-68428PoC $ sudo docker build -t poc . $ sudo docker run --rm -p 8080:8080 --name vuln poc $ curl "http://127.0.0.1:8080/api/v1/generate-invoice?client=Dinko&branding=../secret" --output poc.pdf...
Winter: Stored XSS through Brand Settings custom styles
Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...
GHSA-V7CF-8GH9-GXMJ Winter: Stored XSS through Brand Settings custom styles
Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the custom styles process. An attacker can execute arbitrary scripts in the context of backend users by injecting malicious CSS that is not properly sanitized. This is only exploitable if the attacker has the...
PT-2026-76552
Name of the Vulnerable Software and Affected Versions Winter versions prior to 1.2.13 Description Custom CSS provided through the Brand Settings Styles field is compiled by the LESS parser and rendered without sanitization on every backend page. This allows a user with the backend.manage branding...
Malicious code in cdktn-provider-azurerm (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...
gio-branding-upstream-2.88.3-1.1 on GA media (moderate)
gio-branding-upstream-2.88.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11415-1 Rating: moderate Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2026-15588 SUSE : 4.8...
OPENSUSE-SU-2026:11415-1 gio-branding-upstream-2.88.3-1.1 on GA media
These are all security issues fixed in the gio-branding-upstream-2.88.3-1.1 package on the GA media of openSUSE Tumbleweed...
SUSE CVE-2026-34530
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting XSS via admin-controlled branding fields. An admin who...
CVE-2026-65524
Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...
CVE-2026-65524
Technical details for CVE-2026-65524 are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-48125
Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...
CVE-2026-65524
Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...
CVE-2026-65524 WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability
Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...
CVE-2026-65524 WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability
Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...
WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bonds in WordPress Plugin Avada Custom Branding versions = 1.2...