30 matches found
CVE-2026-108338
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
EUVD-2026-123503
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-108338
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-108338
Apache Roller versions 5.0.1 through 6.1.6 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation, where the tag filter allows HTML characters in tag names. Specifically, the bundled gaurav , fauxcoly ...
CVE-2026-108338 Apache Roller: Stored cross-site scripting through AtomPub entry tags
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-108338 Apache Roller: Stored cross-site scripting through AtomPub entry tags
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-108338: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through…
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
PT-2026-145175
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...
CVE-2026-94031
A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function childprocess.exec of the file src/auth/browser.ts of the component nexusreauth MCP tool. The manipulation of the argument url results in command injection. The...
EUVD-2025-37999
Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup and Move: from n/a through = 0.1...
PT-2025-45222
Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup and Move: from n/a through = 0.1...
CVE-2025-53246: Missing Authorization
Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup and Move: from n/a through = 0.1...
GHSA-MQF3-QPC3-G26Q Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
!IMPORTANT This vulnerability only affects sites which are in the "dev" environment mode. If your production website is in "dev" mode, it has been misconfigured, and you should immediately swap it to "live" mode. See https://docs.silverstripe.org/en/developerguides/debugging/environmenttypes/ for...
Apache Commons Text 1.9 Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Commons Text RCE', 'Description' = %q This exploit takes advantage of the StringSubstitutor interpolator class, which is included in the...
in-passport.tecno.com Cross Site Scripting vulnerability OBB-3121078
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 Apache / 2.4.49 CVE-2021-41773 exploit by G...
Malicious code in xss-test-gaurav (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d4856cf0b438d50d75a5861d08893b7b28643488276db12e9ba3e2d0bb6b1ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-7301 Malicious code in xss-test-gaurav (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d4856cf0b438d50d75a5861d08893b7b28643488276db12e9ba3e2d0bb6b1ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in xss-test-gaurav
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...