960 matches found
CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager
CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data in the Content Manager Menu. Attack Vectors:...
EUVD-2026-106570
Vulnerability in the iProcurement product of Oracle E-Business Suite component: E-Content Manager Catalog. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement. Successful...
EUVD-2026-106514
Vulnerability in the iProcurement product of Oracle E-Business Suite component: E-Content Manager Catalog. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement. Successful...
CVE-2026-91316
Vulnerability in the iProcurement product of Oracle E-Business Suite component: E-Content Manager Catalog. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement. Successful...
CVE-2026-91260
Vulnerability in the iProcurement product of Oracle E-Business Suite component: E-Content Manager Catalog. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement. Successful...
CVE-2026-91316
A vulnerability exists in the iProcurement product of Oracle E-Business Suite , specifically affecting the E-Content Manager Catalog component in versions 12.2.3-12.2.15 . A high-privileged attacker with network access via HTTPS can easily exploit this flaw to compromise and potentially take over...
CVE-2026-91260
The iProcurement product of Oracle E-Business Suite is affected by a vulnerability in the E-Content Manager Catalog component, specifically in supported versions 12.2.3-12.2.15 . A high-privileged attacker with network access via HTTP can easily exploit this flaw to compromise the system, potenti...
CVE-2023-43352-CMSmadesimple-SSTI--Content
CMSmadesimple SSTI v2.2.18 Author: Sergio Description: Server Side Template Injection SSTI vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to use native template syntax to inject a malicious payload into a template, which is then executed server-side. Attack Vectors: A SSTI...
CVE-2026-108114
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
EUVD-2026-96338
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
CVE-2026-108114: Incorrect Authorization
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
PT-2026-109654
Name of the Vulnerable Software and Affected Versions Strapi versions 5.47.0 through 5.57.0 Description An improper authorization issue exists where admin API tokens maintain full access to Content Manager fields even after the owner's role has been restricted. This occurs because the...
Security Bulletin: Bouncy Castle(bcprov and bcpg) security vulnerability in IBM FileNet Content Manager(FNCM) reported for FileNet Deployment Manager(FDM)
Summary IBM FileNet Content ManagerFNCM 5.7.0-IF6 addresses multiple Bouncy Castle CVEs reported for FileNet Deployment ManagerFDM Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This iss...
CVE-2026-39599
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...
CVE-2026-39599 WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...
EUVD-2026-92953
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...