PT-2026-5838

Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0 Description School ERP Pro version 1.0 has a flaw that allows attackers to read arbitrary files without needing to log in. This is possible by manipulating the document parameter within the 'download.php' file. By...

CVE-2026-24737

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or...

CVE-2026-24737

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, or AcroFormRadioButton.appearanceState functions. An attacker can execute arbitrary...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +4 more potentially affected by CVE-2026-24040 via jspdf (4.0.0)

jspdf NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jspdf and may be impacted: - @firedesktop/react-portal-base 2.1.2 - @imaginario27/air-ui-utils =1.0.8, =1.4.0-I18n-QM, =0.5.129, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves:...

MINI-Q39W-MWMM-7XRG

Bulletin has no description...

WordPress SP Project & Document Manager plugin <= 4.71 - Subscriber+ File Download via IDOR vulnerability

Subscriber+ File Download via IDOR vulnerability discovered by fewwords in WordPress Plugin SP Project & Document Manager versions = 4.71...

PT-2026-5791

Уязвимость модуля Acroform прикладного программного интерфейса библиотеки для создания PDF-файлов jsPDF связана с неправильным кодированием или экранированием выходных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный JavaScript-код при...

jsPDF 安全漏洞

jsPDF is a JavaScript-based PDF document generation library developed by Parallax. Versions of jsPDF prior to 4.1.0 contained security vulnerabilities. These vulnerabilities stemmed from the properties and methods of the Acroform module, which allowed users to inject arbitrary PDF objects, such a...

MINI-5QMQ-W669-7GR7

Bulletin has no description...

ECHO-B830-9BC8-D435

Bulletin has no description...

MINI-28C4-3F2P-HCQH

Bulletin has no description...

QWE 跨站脚本漏洞

QWE is a document downloader of QWE Company. Version QWE 2.0.1 has a cross-site scripting vulnerability. This vulnerability stems from input validation issues in path parameter operations, which may lead to storage-based cross-site scripting attacks...

MINI-PV2V-PM77-WFCC

Bulletin has no description...

CGA-P5FM-R5PP-4J6H

Bulletin has no description...

CVE-2026-25156 HotCRP vulnerable to stored XSS via comment attachments

HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Content-Disposition, causing them to be rendered in the user’s browser rather than downloaded. The intended behavior was for only text/plain, application/pdf,...

CVE-2026-25156

HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Content-Disposition, causing them to be rendered in the user’s browser rather than downloaded. The intended behavior was for only text/plain, application/pdf,...

CVE-2026-25156 HotCRP vulnerable to stored XSS via comment attachments

HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Content-Disposition, causing them to be rendered in the user’s browser rather than downloaded. The intended behavior was for only text/plain, application/pdf,...

Security Bulletin: Security vulnerability in min-document may affect IBM Business Automation Workflow - CVE-2025-57352

Summary IBM Business Automation Workflow packages a vulnerable copy of min-document. Vulnerability Details CVEID:CVE-2025-57352 DESCRIPTION: A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttribute...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses min-document which is vulnerable to CVE-2025-57352

Summary IBM Maximo Application Suite - Visual Inspection component uses min-document which is vulnerable to CVE-2025-57352, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-57352 DESCRIPTION: A vulnerability exists in the...