193435 matches found
Joseph Huckaby xyOps Cross-Site Scripting Vulnerability
Joseph Huckaby’s xyOps version 0.9.119 and earlier contain a cross-site scripting vulnerability. This vulnerability arises from the fact that the administrator’s Activity Log includes the item.user.fullname value in the HTML code without proper entity encoding. Additionally, the pixl-server-user...
[SECURITY] [DLA 4831-1] libgit2 security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4831-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley October 12, 2026 https://wiki.debian.org/LTS -...
CVE-2026-108895
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MACaddr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the...
CVE-2026-108896
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...
CVE-2026-103528
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...
CVE-2026-63492
The helper "listFFmpegProcesses$keyword" in "plugin/API/standAlone/functions.php" builds a shell pipeline by interpolating "$keyword" inside single quotes and running it with "exec": The two callers in "plugin/API/standAlone/ffmpeg.json.php" the "list" mode and the "isKeywordRunning" mode pass th...
CVE-2026-63494
The standalone FFmpeg execution endpoint "plugin/API/standAlone/ffmpeg.json.php" builds a shell command string that is passed to "execAsync" and run via "nohup sh -c """. When the decrypted "codeToExec" payload produces a non-empty "avideoPath", the endpoint appends a completion hook of the form:...
CVE-2026-103528 CVE-2026-103528
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...
CVE-2026-103528
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...
CVE-2026-103528
The open-source e-commerce platform Thelia v2.6.0 is vulnerable to Remote Code Execution (RCE) due to improper restrictions on the Smarty template engine . An authenticated administrator can inject malicious Smarty expressions into email templates through the messages configuration interface . Wh...
EUVD-2026-97480
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...
CVE-2026-108896 Linksys E1700 setLinksysIpv6 os command injection
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...
CVE-2026-108896
The Linksys E1700 (version 1.0.0.4.003 ) is vulnerable to OS command injection due to improper neutralization of special elements in the setLinksysIpv6 function located at /goform/setLinksysIpv6. An attacker can achieve remote command execution by manipulating the _6rd_prefix or _6rd_prefix_len a...
CVE-2026-108896 Linksys E1700 setLinksysIpv6 os command injection
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...
EUVD-2026-97470
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...
CVE-2026-18390
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document...
CVE-2026-108894
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument...
CVE-2026-108895
A vulnerability exists in Linksys E1700 version 1.0.0.4.003 involving OS command injection . The flaw is located in the setDMZ function within the /goform/setDMZ file. An attacker can trigger the injection by manipulating the MAC_addr argument. This attack can be executed remotely , and a public ...
CVE-2026-108895 Linksys E1700 setDMZ os command injection
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MACaddr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the...
CVE-2026-108895 Linksys E1700 setDMZ os command injection
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MACaddr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the...