19050 matches found
CVE-2026-30944 StudioCMS Affected by Privilege Escalation via Insecure API Token Generation
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocmsapi/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to...
CVE-2026-30944
CVE-2026-30944 affects StudioCMS prior to 0.4.0. The vulnerability resides in the /studiocms_api/dashboard/api-tokens endpoint, where any authenticated user (at least Editor) can generate API tokens for any target user, bypassing authorization checks to create tokens on behalf of others. This lea...
CVE-2026-30944 StudioCMS Affected by Privilege Escalation via Insecure API Token Generation
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocmsapi/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to...
CVE-2026-30944 StudioCMS Affected by Privilege Escalation via Insecure API Token Generation
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocmsapi/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to...
CVE-2025-53608
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability CWE-79 vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileg...
Microsoft Excel Information Disclosure Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...
CVE-2025-70038
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in linagora Twake v2023.Q1.1223. This allows attackers to execute arbitrary code...
CVE-2025-70033
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...
CVE-2025-70060
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0...
RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface
Impact Vulnerability Type: Improper Control of Generation of Code 'Code Injection' CWE-94 / Improper Check for Unusual or Exceptional Conditions CWE-754 / Improper Input Validation CWE-20 / Use of Low-Level Functionality CWE-695 / Improper Privilege Management CWE-269 / External Control of System...
CVE-2025-70025
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in benkeen generatedata 4.0.14...
CVE-2025-70025
CVE-2025-70025 concerns benkeen generatedata 4.0.14, with a vulnerability described as CWE-79: Improper Neutralization of Input During Web Page Generation. The connected sources consistently identify benkeen generatedata 4.0.14 as affected. CVSSv3.1 base score is 6.1 (MEDIUM) with network access,...
PT-2026-24232
šØ CVE-2025-53608 An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability CWE-79 vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an...
CVE-2025-70025
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in benkeen generatedata 4.0.14...
HPESBNW05022 rev.1 - HPE Telco Intelligent Assurance, Improper Control of Generation of Code vulnerability
Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 4.2.14 - FAS and PDO 4.2.14 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-33042 |...
Fortinet FortiSIEM č·Øē«čę¬ę¼ę“
Fortinet FortiSIEM is a security information and event management system developed by the American company Fortinet. This system includes features such as asset discovery, workflow automation, and unified management. Versions of Fortinet FortiSIEM ranging from 7.3.0 to 7.3.4 contain a cross-site...
PT-2026-24337
Microsoft Office Excel and Affected Versions Microsoft Office Excel versions prior to the March 2026 Patch Tuesday update Description A critical issue exists in Microsoft Excel related to the improper handling of input during web page generation, specifically a cross-site scripting XSS flaw. This...
PT-2026-24218
Name of the Vulnerable Software and Affected Versions benkeen generatedata version 4.0.14 Description An issue exists due to Improper Neutralization of Input During Web Page Generation. This affects the application's handling of user-supplied data when generating web pages, potentially allowing f...
generatedata å®å Øę¼ę“
Generatedata is a random data generation engine developed by Ben Keen as an individual developer. Version 4.0.14 of Generatedata contains a security vulnerability, which stems from improper input during web page generation...
PT-2026-24619
Summary The /studiocms api/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target...