Progress-MOVEit-Transfer-2020.1-Stored-XSS-CVE-2020-28647

Progress MOVEit Transfer 2020.1 XSS almacenado CVE-2020-28647 Durante una reciente prueba de aplicaciones web, una de las aplicaciones en el alcance era una aplicación web MOVEit Transfer 2020. Durante la evaluación, se identificó una vulnerabilidad de Cross-Site Scripting XSS almacenado. Esta...

CVE-2025-65754

CVE-2025-65754 : Stored XSS in Algernon 1.17.4 Description Algernon v1.17.4 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload into a filename. Affected Project : Algernon - 1.17.4 Project maintainer : Alexander F. Rødseth...

CVE-2025-69212

CVE-2025-69212 Description OpenSTAManager is a management software solution for technical assistance, electronic invoicing, and accounting. The versions =2.9.8 are vulnerable to an authenticated remote code execution vulnerability. An attacker can exploit this issue by uploading a specially craft...

Astra Linux - Vulnerability in Golang-1.23

The “go tool pack” subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames. Extracting a malicious archive file using the “pack” subcommand can result in files being written to arbitrary locations within the filesystem...

CVE-2026-73693 FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-38473

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

JLSEC-2026-1378

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-73254 Mongoose: Stored XSS via unescaped filenames in directory listing

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

CVE-2026-74902

SiYuan (note-taking app) before v3.7.4 has a file upload validation flaw: filenames are inserted into HTML via insertAdjacentHTML without escaping. A crafted filename carrying script payloads triggers XSS that escalates to full OS command access when a victim drags, drops, or pastes the file into...

EUVD-2026-60583

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

BIT-RCLONE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-18127

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...

CVE-2026-18127

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-48120 Kakoune has a Critical RCE via Autorestore Backup Filename Injection

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...

CVE-2026-48120 Kakoune has a Critical RCE via Autorestore Backup Filename Injection

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...

CVE-2026-48120

Kakoune (the code editor) is affected by CVE-2026-48120 through the bundled, enabled-by-default autorestore.kak script. Prior to version 2026.05.21, malicious backup files could trigger arbitrary Kakoune and shell commands when a file is opened. The issue is addressed in Kakoune 2026.05.21. A wor...