41078 matches found
CVE-2020-37088 School ERP Pro 1.0 - Arbitrary File Read
School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system...
cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
A flaw was found in cpython. This vulnerability allows impacted availability via a quadratic algorithm in xml.dom.minidom methods, such as appendChild, when building excessively nested documents due to a dependency on clearidcache...
CVE-2026-24958
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through = 2.7.12.2...
Malicious Package
Overview typed-document-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-667 Malicious code in typed-document-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aee62441fa4b75c4aee1044c18d8043570ba9e43b3034ce3ea6ae70aabf8373 The package typed-document-node was found to contain malicious code. Source: ghsa-malware...
Malicious code in typed-document-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aee62441fa4b75c4aee1044c18d8043570ba9e43b3034ce3ea6ae70aabf8373 The package typed-document-node was found to contain malicious code. Source: ghsa-malware...
PT-2026-5838
Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0 Description School ERP Pro version 1.0 has a flaw that allows attackers to read arbitrary files without needing to log in. This is possible by manipulating the document parameter within the 'download.php' file. By...
EUVD-2025-206725
An arbitrary file upload vulnerability in the AddFont function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file...
CVE-2020-37088: Improper Limitation of a Pathname to a Restricted Directory
School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system...
CVE-2026-24737
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or...
CVE-2026-24737
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the AcroformChoiceField.addOption, AcroformChoiceField.setOptions, AcroFormCheckBox.appearanceState, or AcroFormRadioButton.appearanceState functions. An attacker can execute arbitrary...
@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +4 more potentially affected by CVE-2026-24040 via jspdf (4.0.0)
jspdf NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jspdf and may be impacted: - @firedesktop/react-portal-base 2.1.2 - @imaginario27/air-ui-utils =1.0.8, =1.4.0-I18n-QM, =0.5.129, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves:...
MINI-Q39W-MWMM-7XRG
Bulletin has no description...
WordPress SP Project & Document Manager plugin <= 4.71 - Subscriber+ File Download via IDOR vulnerability
Subscriber+ File Download via IDOR vulnerability discovered by fewwords in WordPress Plugin SP Project & Document Manager versions = 4.71...
PT-2026-5791
Уязвимость модуля Acroform прикладного программного интерфейса библиотеки для создания PDF-файлов jsPDF связана с неправильным кодированием или экранированием выходных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный JavaScript-код при...
jsPDF security vulnerability
jsPDF is a JavaScript-based PDF document generation library developed by Parallax. Versions of jsPDF prior to 4.1.0 contained security vulnerabilities. These vulnerabilities stemmed from the properties and methods of the Acroform module, which allowed users to inject arbitrary PDF objects, such a...
MINI-5QMQ-W669-7GR7
Bulletin has no description...