CVE-2026-40597 MantisBT has a Content Security Policy bypass via attachments

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, when accessed via th...

CVE-2026-40597: Improper Neutralization of Input During Web Page Generation

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, when accessed via th...

CVE-2026-34735: Unrestricted Upload of File with Dangerous Type

The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prior, the quickUpload endpoint validates uploaded files by checking their MIME type via PHP's finfo, which inspects file contents but constructs the stored filename using the...

EUVD-2026-14482

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload...

SUSE CVE-2013-4636

The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service invalid pointer dereference and application crash via an MP3 file that triggers incorrect MIME type detection during access to an finfo object...

The vulnerability of the implementation of the finfo_buffer() function in the PHP programming language allows a hacker to execute arbitrary code.

The vulnerability of the finfobuffer function implementation in the PHP programming language is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2022-3933 · Php +4 · Php +4

Name of the Vulnerable Software and Affected Versions: PHP versions 8.1.x below 8.1.8 Description: The issue is related to the implementation of the finfo buffer function in PHP, which can lead to heap corruption due to the incorrect use of a function to free allocated memory. This is caused by a...

PT-2022-3812

Name of the Vulnerable Software and Affected Versions Fujitsu ETERNUS CentricStor CS8000 versions prior to 8.1A SP02 P04 Description The issue is related to the possibility of command injection in the Fujitsu ETERNUS CentricStor CS8000 device. An attacker can influence the username user, password...

PT-2021-27544

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is reported, which can cause a crash. The crash state involves functions such as loop and ftp pl insert finfo. No...

The vulnerability of the PHP interpreter allows attackers to read arbitrary files or write to them.

The vulnerability of the PHP interpreter lies in the lack of checks for the sequence “%00” in the path name. Exploiting this vulnerability allows an attacker to read arbitrary files or write to them using specially crafted input data for an application that calls the method DOMDocument.load, the...

SOL15272 - PHP Vulnerability CVE-2013-4636

The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service invalid pointer dereference and application crash via an MP3 file that triggers incorrect MIME type detection during access to an finfo object...

PT-2013-1340

Name of the Vulnerable Software and Affected Versions PHP versions 5.4.x before 5.4.16 Description The issue exists due to insufficient input validation in the mget function of the PHP interpreter. This can be exploited by a remote attacker to cause a denial of service, resulting in an applicatio...