CVE-2026-112138

A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely...

CVE-2026-112042

A cross-site scripting (XSS) vulnerability exists in the diem-project diem software within the dmWidget component. The flaw is located in the dmBaseLinkTag::text function of the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php. By manipulating the text argument, an attacker can trigger the ...

EUVD-2026-104048

A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects the function dmBaseLinkTag::text of the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php of the component dmWidget. Performing a manipulation of the argument text...

CVE-2026-112041

A vulnerability exists in diem-project diem (up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad) affecting the dmString::random function within the file dmCorePlugin/lib/basic/dmString.php . The underlying cause is a cryptographically weak PRNG (CWE-338, CWE-331). This flaw allows for potentia...

EUVD-2026-104044

A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from...

EUVD-2026-104043

A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes...

CVE-2026-112039

The diem-project diem software is vulnerable to a Cross-Site Scripting (XSS) flaw in the Administrative Console component. Specifically, the append function within the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php fails to properly neutralize the dm_command argument. This vulnera...

EUVD-2026-104042

A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dmcommand...

CVE-2026-112038

A cross-site scripting (XSS) vulnerability exists in the diem-project diem software (up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad). The flaw is located in the html function within the dmAdminPlugin/web/js/dmAdminCtrl.js file of the Version Check Service component. This vulnerability allo...

EUVD-2026-104033

A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote...

CVE-2026-112037

A flaw in the Google Analytics Client component of diem-project diem (up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad) allows for improper certificate validation via an unknown function in dmCorePlugin/lib/vendor/gapi/gapi.class.php. This vulnerability can be triggered remotely, though it r...

EUVD-2026-104032

A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The...

EUVD-2026-104015

A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public a...

EUVD-2026-104013

A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...

CVE-2026-112030

The diem-project diem software, up to version 5.1.3 , contains a vulnerability in the dmCorePlugin/lib/data/dmDataLoad.php file. An attacker can perform a remote manipulation that results in the use of default passwords (CWE-1393 ). While the project has not yet responded to the initial report, i...

CVE-2026-112029

A vulnerability exists in diem-project diem versions up to 5.1.3 within the SHA1 Handler component, specifically affecting a part of the file lib/model/doctrine/PluginDmUser.class.php. The root cause involves the manipulation of the salt/password argument, resulting in a password hash with insuff...

CVE-2026-86182

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dmcommand causes cross-site request forgery. The attack may...

CVE-2026-86183

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widgetid leads to authorization bypass. The attack may...

CVE-2026-86183 diem-project diem dmWidget BasedmWidgetActions.class.php authorization

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widgetid leads to authorization bypass. The attack may...

CVE-2026-86183

diem-project diem (versions up to 5.1.3 ) contains an authorization bypass vulnerability in the dmWidget component, specifically in the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php. Manipulation of the widget_id argument allows a remote, unauthenticated attacker to bypass...