CVE-2025-29867

CVE-2025-29867 describes a type confusion vulnerability in Hancom Office products (Office 2018, 2020, 2022, 2024) that permits file content injection. Affected versions are: Office 2018 before 10.0.0.12681; Office 2020 before 11.0.0.8916; Office 2022 before 12.0.0.4426; Office 2024 before 13.0.0....

CVE-2025-29867

Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Hancom Inc. Hancom Office 2018, Hancom Inc. Hancom Office 2020, Hancom Inc. Hancom Office 2022, Hancom Inc. Hancom Office 2024 allows File Content Injection.This issue affects Hancom Office 2018: before 10.0.0.12681;...

Hancom Office 安全漏洞

Hancom Office is a mobile office application developed by Hancom Corporation in South Korea. This program supports the viewing and editing of documents in various formats. There is a security vulnerability in Hancom Office, which stems from type confusion and may lead to file content injection. T...

PT-2026-5905

Name of the Vulnerable Software and Affected Versions HCL AION version 2.0 Description HCL AION is affected by a missing Content-Security-Policy CSP header. The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or...

CVE-2025-14616

The Recooty – Job Widget Old Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing nonce validation on the recootysavemaybe function. This makes it possible for unauthenticated attackers to update the...

CVE-2026-24784

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0...

CVE-2025-10856

Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection.This issue affects Teknoera: through 01102025...

CVE-2025-10856

Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through 01102025...

CVE-2025-10856 Arbitrary File Upload in Solvera Software's Teknoera

Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through 01102025...

CVE-2025-10856

Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through 01102025...

CVE-2025-10856

CVE-2025-10856 concerns Teknoera (Solvera Software Services Trade Inc.). Public records describe an Unrestricted Upload of File with Dangerous Type vulnerability that enables File Content Injection in Teknoera up to version/date 01102025. The CVSS 3.1 base metrics indicate a HIGH severity (8.1), ...

CVE-2025-10856 Arbitrary File Upload in Solvera Software's Teknoera

Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through 01102025...

PT-2026-3930

Name of the Vulnerable Software and Affected Versions Teknoera versions through 01102025 Description An unrestricted file upload issue exists in Teknoera, potentially allowing file content injection. The issue allows for the upload of files with dangerous types. Recommendations Versions through...

CVE-2025-41768

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation 'Cross-site Scripting'...

CVE-2026-22919

An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting XSS attacks, leading to the extraction of sensitive data...

PT-2026-3000

Name of the Vulnerable Software and Affected Versions affected versions not specified Description An attacker with administrative access can inject malicious content into the login page, potentially enabling cross-site scripting XSS attacks. This could lead to the extraction of sensitive data. XS...

CVE-2021-28963

Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters...

CVE-2022-26596

Cross-site scripting XSS vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via we...

CVE-2026-21439 badkeys vulnerable to ASCII control character injection on console via malformed input

badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line...

Security Bulletin: Components with known vulnerabilities in IBM Security QRadar Analyst Workflow for IBM QRadar SIEM

Summary Multiple components with known vulnerabilities were addressed in a IBM Security QRadar Analyst Workflow for IBM QRadar SIEM release Vulnerability Details CVEID:CVE-2025-64756 DESCRIPTION: Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions...