CVE-2026-100694

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...

CVE-2026-50163: Improper Limitation of a Pathname to a Restricted Directory

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", " /payload.tar.gz/evilcwdlink" to resolve header.Linkname...

CVE-2026-54004

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview...

CVE-2026-54004 Kirby: Access to files of top-level drafts is not protected by permissions

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview...

CVE-2026-54004 Kirby: Access to files of top-level drafts is not protected by permissions

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview...

CVE-2026-54004

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the content.fileRedirects process. An attacker can gain unauthorized access to files in top-level drafts by directly requesting clean file URLs, bypassing authentication and authorization checks. This is only...

EUVD-2026-20823

A vulnerability was determined in code-projects Simple IT Discussion Forum 1.0. The impacted element is an unknown function of the file /pages/content.php. This manipulation of the argument postid causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

📄 Samsung QuramDng Out-Of-Bounds Write

Samsung QuramDng has an invalid LossyJpeg component assumption that leads to an out-of-bounds write. BACKGROUND Samsung Android uses an internal DNG decoding library, QuramDng in libimagecodec.quram.so, to decode images in com.samsung.ipservice and com.samsung.gallery3d. Samsung Gallery will deco...

CVE-2025-11102

CVE-2025-11102 affects Campcodes Online Learning Management System (v1.0). A vulnerability in an unknown function within /admin/edit_content.php allows manipulation of the Title parameter to trigger SQL injection. Exploitation can be conducted remotely, and public exploits are noted. Several sour...

CVE-2025-11077 Campcodes Online Learning Management System add_content.php sql injection

A vulnerability was determined in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/addcontent.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclose...

pentest_compilation

It is an offensive tool for Windows. The repository contains a compilation of commands, tips, and scripts used for penetration testing and red teaming exercises. The provided code snippet is an XML file named "detalle.SettingContent-ms" located in the "Phishing" directory. This file appears to be...

SourceCodester Simple Company Website 安全漏洞

SourceCodester Simple Company Website is a simple company website from SourceCodester, Inc. A security vulnerability exists in SourceCodester Simple Company Website version 1.0, which originates from an unrestricted upload due to incorrect manipulation of the parameter img in the file...

CVE-2024-25297

Cross Site Scripting XSS vulnerability in Bludit CMS version 3.15, allows remote attackers to execute arbitrary code and obtain sensitive information via edit-content.php...

Bludit Security Breach

Bludit is an open source lightweight blog content management system CMS. A security vulnerability exists in Bludit CMS version 3.15, which stems from a cross-site scripting XSS vulnerability in the file edit-content.php...

PT-2023-31985 · Huakecms · Huakecms

Name of the Vulnerable Software and Affected Versions: huakecms version 3.0 Description: A critical vulnerability was found in huakecms, affecting an unknown functionality of the file /admin/cms content.php. The manipulation of the cid argument leads to SQL injection. The attack can be launched...

Kirby XSS Vulnerability

A cross-site Scripting XSS vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file...

GHSA-275C-V3RC-XGHX Kirby XSS Vulnerability

A cross-site Scripting XSS vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file...

CVE-2020-13145

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...

Microsoft Windows: Turn off Search Companion content file updates

This test checks the setting for policy OpenVAS Vulnerability Test $Id: wincontentfileupdates.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Turn off Search Companion content file updates Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net...