CVE-2024-39031

CVE-2024-39031 : ثغرة XSS مخزنة في Silverpeas Core في Mes agendas معلومات الوصف: في Mes Agendas، يمكن للمستخدم إنشاء أحداث جديدة وإضافتها إلى تقويمه. بالإضافة إلى ذلك، يمكن للمستخدمين دعوة آخرين من نفس المجال، بما في ذلك المسؤولين، إلى هذه الأحداث. يمكن لمستخدم عادي حقن حمولة XSS في حقلي "Titre"...

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

PT-2026-93257

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 10.0.9 Description The software uses the PHP rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs. Because rand is not a cryptographically secure generator, remote...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when inviting users to an event. An attacker can execute arbitrary web script or inject HTML by supplying crafted input into the First Name, Middle text, or Last Name fields. Details Cross-site scripting or XSS ...

New PDF Attack Targets Aviation Defense Industry

FireEye reported today it had detected a new critical PDF attack targeting the aviation defense industry. Malware Page exploits a stack-based buffer overflow vulnerability in Adobe Acrobat and Adobe Reader. An attacker would be able to execute code remotely via a crafted argument to the getIcon...