CVE-2021-47925 CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting

CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted input in card creation and file upload endpoints. Attackers can inject XSS payloads through Employee card parameters or SVG file...

CVE-2024-4322

creationtimestamp| type| source ---|---|--- 2026-05-10 12:00:46+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-4322.yaml...

CVE-2026-45369

creationtimestamp| type| source ---|---|--- 2026-05-10 11:59:32+00:00| published-proof-of-concept| https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-33p6-5jxp-p3x4 2026-05-14 22:10:29+00:00| seen| https://gist.github.com/alon710/b6fd947590993b5b0ed338c431321c...

CVE-2026-8241

creationtimestamp| type| source ---|---|--- 2026-05-10 10:55:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlilvg2n4k2v...

CVE-2026-8244

creationtimestamp| type| source ---|---|--- 2026-05-10 10:50:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlilmhn7vz2e...

CVE-2026-8243

creationtimestamp| type| source ---|---|--- 2026-05-10 10:45:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlildj7d7c2q...

CVE-2026-8224

creationtimestamp| type| source ---|---|--- 2026-05-10 08:12:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlicsinm772n...

CVE-2026-8232

creationtimestamp| type| source ---|---|--- 2026-05-10 07:19:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mli7sxhsdd2v...

CVE-2026-8219

creationtimestamp| type| source ---|---|--- 2026-05-10 04:40:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlhwy6cxux2e...

CVE-2026-8217

creationtimestamp| type| source ---|---|--- 2026-05-10 04:30:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlhwgbfuff2h...

PT-2026-41191

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.5 Description An authenticated attacker can perform mass assignment via the 'POST /api/v1/evaluations/feedback' endpoint. This is possible because the FeedbackForm uses a configuration that allows extra fields,...

CMDBuild 跨站脚本漏洞

CMDBuild is an open-source web-based enterprise environment for configuring custom applications for asset management. Version 3.3.2 of CMDBuild contains a cross-site scripting vulnerability. This vulnerability stems from multiple stored-cross-site scripting vulnerabilities, allowing authenticated...

Evolution CMS 代码注入漏洞

Evolution CMS is an open-source content management system based on PHP, developed by Evolution CMS. Version 3.1.6 of Evolution CMS has a code injection vulnerability. This vulnerability stems from a remote code execution flaw, allowing authenticated users with module creation permissions to execu...

PT-2026-39498

Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Attackers can add JavaScript payloads in the title field when creating or editing sliders, which executes in the browsers of...

PT-2026-39514

Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system commands by injecting PHP code into module parameters. Attackers can send POST requests to /manager/index.php with malicious PHP code in...

PT-2026-39501

CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted input in card creation and file upload endpoints. Attackers can inject XSS payloads through Employee card parameters or SVG file...

PT-2026-39508

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp register and login ajax action with tcp role set to...

CVE-2026-45347

creationtimestamp| type| source ---|---|--- 2026-05-09 22:47:27+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-f776-fp4w-266c 2026-05-16 00:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlwmx6fwfz2t...

CVE-2026-42576

creationtimestamp| type| source ---|---|--- 2026-05-09 21:44:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlh7qghol32h...

CVE-2026-42245

creationtimestamp| type| source ---|---|--- 2026-05-09 21:13:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlh5y7rxta2k 2026-05-10 12:01:28+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mliplx57y32v 2026-07-18 12:01:17+00:00| seen|...