59354 matches found
CVE-2021-47779 Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation
Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the...
CVE-2021-47779
Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the...
CVE-2021-47779 Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation
Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the...
CVE-2021-47779
Dolibarr ERP-CRM 14.0.2 is affected by a stored cross-site scripting (XSS) vulnerability in the ticket creation module. The issue allows a low-privilege user to inject JavaScript that can be executed when an administrator copies the crafted ticket text, with potential privilege escalation. Techni...
CVE-2026-1010
A stored cross-site scripting XSS vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an administrator views the affected workflow,...
CVE-2026-1010 Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation
A stored cross-site scripting XSS vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an administrator views the affected workflow,...
CVE-2026-22863
creationtimestamp| type| source ---|---|--- 2026-01-15 22:40:46+00:00| published-proof-of-concept| https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v 2026-01-19 04:03:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mcqr5g3vgr2l 2026-01-19 17:38:42+00:00|...
CVE-2026-21908
creationtimestamp| type| source ---|---|--- 2026-01-15 21:53:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcikzsnru22g...
CVE-2026-21906
creationtimestamp| type| source ---|---|--- 2026-01-15 21:46:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcikoaknau2y 2026-01-15 22:00:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcili2ytfq2p 2026-01-15 22:08:20+00:00| seen|...
CVE-2025-62004
creationtimestamp| type| source ---|---|--- 2026-01-15 21:08:20+00:00| seen| Telegram/pFQxzC0HcGfQDDozTmsk7R-twPB5SKoRgE9d8sDqRJYZzg...
GHSA-54V4-4685-VWRJ alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
Summary application/core/EASecurity.php::csrfverify only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET or $REQUEST, so an attacker can perform CSRF by forcing a victim's...
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
Summary application/core/EASecurity.php::csrfverify only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET or $REQUEST, so an attacker can perform CSRF by forcing a victim's...
Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE
Summary Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitizati...
CVE-2026-22774
creationtimestamp| type| source ---|---|--- 2026-01-15 20:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcieqy4xwp2u 2026-01-15 20:54:55+00:00| seen| https://bsky.app/profile/isabelroses.com/post/3mcihrxhg6h2z 2026-01-16 02:26:07+00:00| seen|...
CVE-2026-23622
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EASecurity.php::csrfverify only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from...
CVE-2026-23520
Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to r...
CVE-2021-47757
creationtimestamp| type| source ---|---|--- 2026-01-15 17:56:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mci5s72avt2y...
CVE-2025-62193
creationtimestamp| type| source ---|---|--- 2026-01-15 17:50:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mci5i4z5no2f 2026-01-15 18:27:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mci7ketomq2e 2026-01-15 20:42:35+00:00| seen|...
CVE-2021-47763
creationtimestamp| type| source ---|---|--- 2026-01-15 17:39:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mci4uha4xs2c 2026-01-24 21:24:14+00:00| seen| https://gist.github.com/alon710/3b07531c6b595c0a80bb2e3df9747d4c 2026-01-24 22:29:44+00:00| seen|...