CVE-2026-84841

tsi-coop tsi-dpdp-cms versions up to 0.5.0 contain a flaw where server-side security is enforced only on the client side , allowing a remote, unauthenticated attacker to bypass authentication via direct HTTP requests. The exploit has been published as a proof-of-concept (see exploit repository )....

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

Prototype Pollution

Overview livewire/livewire is an A front-end framework for Laravel. Affected versions of this package are vulnerable to Prototype Pollution in the client-side state handling process. An attacker can execute arbitrary JavaScript in the context of the affected application by tricking a user into...

EUVD-2026-68765

Livewire DOM-based cross-site scripting during client-side state handling...

Livewire DOM-based cross-site scripting during client-side state handling

Impact In Livewire v3 ≤ 3.8.2 and v4 ≤ 4.3.3, a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affec...

GHSA-G3HC-697W-WM82 Livewire DOM-based cross-site scripting during client-side state handling

Impact In Livewire v3 ≤ 3.8.2 and v4 ≤ 4.3.3, a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affec...

CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

EUVD-2025-210823

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

CVE-2025-15663 BEAF < 4.7.19 - Author+ Stored XSS via After Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

EUVD-2026-69721

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

PT-2026-84852

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

PT-2026-84653

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The reset password.html page parses query string parameters and uses the url parameter as a redirection target via window.location = url following a password...

CVE-2026-84841: Client-Side Enforcement of Server-Side Security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

Bluetooth Component DoS

The vulnerability of the Bluetooth components in Google Chrome and Microsoft Edge browsers is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...

Serial Component DoS

The vulnerability of the Serial component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...

Network Component Compromise Data Compromise

The vulnerability of the Network component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

Actor component Data Compromise

The vulnerability of the Actor component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...