1148663 matches found
PT-2026-83611
A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of the file /api/add customer.php. This manipulation of the argument Name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used...
Debian dsa-6479 : roundcube - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6479 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6479-1 [email protected] https://www.debian.org/securit...
PT-2026-83540
Name of the Vulnerable Software and Affected Versions Beetel 450TC3 version 01.00.00 01 Description An issue exists within the User Management component where the manipulation of the Username argument allows for remote cross site scripting. Cross site scripting is a technique where malicious...
CVE-2026-82483: Improper Neutralization of Input During Web Page Generation
A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file dbinput.php of the component Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit is n...
PT-2026-83530
Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.6.29 Description A remote cross site scripting issue exists within the Hidden Album Update Endpoint in the db input.php file. Cross site scripting is a technique where malicious scripts are injected...
[SECURITY] [DLA 4760-1] roundcube security update
Debian LTS Advisory DLA-4760-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 29, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.4.15+dfsg.1-1+deb11u11 1.6.5+dfsg-1+deb12u11 CVE ID : CVE-2026-74997 CVE-2026-74998 CVE-2026-74999...
CVE-2026-82451
Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...
WordPress User Profile Builder plugin < 4.0.1 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Profile Builder versions 4.0.1...
Web--Vulnerability-scanner
Web--Vulnerability-scanner A web vulnerability scanner i...
Debian dla-4760 : roundcube - security update
The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4760 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4760-1 [email protected]...
Freenet: Deanonymization Vulnerability
Background Freenet is an encrypted network without censorship. Description A vulnerability has been discovered in Freenet. Please review the CVE identifier referenced below for details. Impact This release fixes as an XSS vulnerability that may allow an attacker to deanonymize the user. Workaroun...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ArchiveAdmin restore process. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious content into the page title field during the restore operation. Details...
EUVD-2026-68015
Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...
CVE-2026-76794
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
CVE-2026-50980
Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...
CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
CVE-2026-55247 plone.app.event: Denial of service via iCalendar import
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...
CVE-2026-55248
plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in...
EUVD-2026-67845
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...