CVE-2026-87926 Rizwan17 inventory-management-system Login Page index.php cross site scripting

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...

CVE-2026-87926 Rizwan17 inventory-management-system Login Page index.php cross site scripting

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...

CVE-2026-87926

CVE-2026-87926 affects the Rizwan17 inventory-management-system (GitHub project), up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f . The vulnerability is a cross-site scripting (XSS) flaw in the Login Page component, specifically in the file index.php . Manipulation of the msg argument allow...

CVE-2026-87926 Rizwan17 inventory-management-system Login Page index.php cross site scripting

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...

CVE-2026-87923

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument...

github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content

A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting XSS, executing...

CVE-2026-87923 Rizwan17 inventory-management-system List DBOperation.php cross site scripting

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument...

CVE-2026-87923

CVE-2026-87923 affects the Rizwan17 inventory-management-system GitHub project, specifically the List Handler component in the file includes/DBOperation.php. The vulnerability is a cross-site scripting (XSS) flaw caused by improper handling of the category_name, brand_name, and product_name argum...

CVE-2026-87923 Rizwan17 inventory-management-system List DBOperation.php cross site scripting

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument...

CVE-2026-87923 Rizwan17 inventory-management-system List DBOperation.php cross site scripting

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument...

CVE-2026-75307

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...

CVE-2026-75308

yshopmall =3.3 is vulnerable to Cross Site Scripting XSS. The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files...

Security Bulletin: IBM Informix HQ is affected by multiple vulnerabilities in third-party libraries.

Summary Multiple security vulnerabilities in third-party and open-source dependencies affect IBM Informix HQ. These flaws include Denial of Service via memory exhaustion or inefficient regular expressions, host parser interpretation conflicts leading to potential SSRF/redirect bypass, cross-site...

Security Bulletin: the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-69151 DESCRIPTION: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline...

Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server Liberty affect IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is exposed to multiple security vulnerabilities, including Tampering / Information Disclosure CVE-2025-12635, Information Disclosure CVE-2025-14923, two Denial of Service CVE-2026-11897 and CVE-2026-15057, and two Elevation of Privilege vulnerabilities...

RLSA-2026:65534 Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Certificat...

image-builder security update

An update is available for image-builder. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A local binary for building customized OS artifacts such as VM images...

DRUPAL-CONTRIB-2026-147

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity...

DRUPAL-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

DRUPAL-CONTRIB-2026-137

The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting XSS vulnerability...