CVE-2026-17597 Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification

Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...

CVE-2026-17597 Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification

Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...

CVE-2026-54217

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528...

CVE-2026-54217

CVE-2026-54217 affects Tobit Laboratories AG TeamDavid’s Webbox. It describes a stored XSS where an attacker can embed malicious JavaScript in an email; when a user opens the email, the stored payload is executed. Affected scope is TeamDavid through Rollout 524. CVSSv4.0 vector: AV:N/AC:L/PR:N/UI...

EUVD-2026-54448

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524...

CVE-2026-54217 TeamDavid: Stored XSS in web application

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528...

CVE-2026-54217

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524...

CVE-2026-54217 TeamDavid: Stored XSS in web application

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528...

Updated python-django packages fix security vulnerabilities

The updated package fixes security vulnerabilities: Signed cookie salt namespace collision in django.http.HttpRequest.getsignedcookie. CVE-2026-6873 Potential unencrypted email transmission via STARTTLS in the SMTP backend. CVE-2026-7666 Potential exposure of private data via case-sensitive...

CVE-2026-19196

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

EUVD-2026-54388

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...

CVE-2026-14331 Subscribe2 < 10.46 - Reflected XSS via email Parameter

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CVE-2026-14331 Subscribe2 < 10.46 - Reflected XSS via email Parameter

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CVE-2026-14331

The Subscribe2 WordPress plugin, in versions before 10.46 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the improper escaping of a user-supplied value before it is reflected into a public subscription form. An unauthenticated visitor can execute malicious scripts in ...

CVE-2026-19196

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

CVE-2026-17597: Server-Side Request Forgery (SSRF)

Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...

CVE-2026-54217: Improper Input Validation

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528...

CVE-2026-66000: Incorrect Authorization

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-19196: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

CVE-2026-19211: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made publ...