CVE-2026-90942

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in the /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. An attacker with this low-privilege access can use the exposed key to forge JWT tokens for any us...

Cross-Site Scripting (XSS)

github.com/arduino/arduino-create-agent is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of user input and custom error messages sanitization in the /certificate.crt endpoint. This allows attackers to execute Reflected Cross-Site Scripting XSS attacks through specially...

PT-2023-24731 · Keyfactor · Keyfactor Ejbca

Name of the Vulnerable Software and Affected Versions: Keyfactor EJBCA versions prior to 8.0.0 Description: The issue is related to an authentication problem in the RA web certificate distribution servlet, specifically at the "/ejbca/ra/cert" endpoint. This can lead to a partial denial of service...

The vulnerability of Barracuda CloudGen WAN’s web interface allows a attacker to execute arbitrary commands.

The vulnerability of the Barracuda CloudGen WAN web interface is related to insufficient protection of the web page structure when processing the end point /ajax/updatecertificate. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted HT...