CVE-2026-66491

PhocaCommander の getSource を介した任意ファイル読み取り PhocaCommander ≤ 6.1.3 — 認証済み管理者によるパストラバーサル、CSRF 不要 概要 PhocaCommander のファイルエディタエンドポイントには、任意ファイル読み取りの脆弱性が存在します。getSource 関数は、base64 エンコードされた filename パラメータをデコードし、パス包含チェックなしで直接 filegetcontents に渡します。認証済み管理者は、GET リクエストを送信するだけで、Web...

CVE-2021-2471

CVE-2021-2471 - MySQL Connector/J における XXE Oracle MySQL の MySQL Connectors 製品の脆弱性（コンポーネント: Connector/J）。影響を受けるサポート対象バージョンは 8.0.26 およびそれ以前です。 この脆弱性の攻撃が成功すると、重要なデータへの不正アクセス、または MySQL Connectors がアクセス可能なすべてのデータへの完全なアクセスが可能になり、さらに MySQL Connectors のハングアップや頻繁に繰り返されるクラッシュ（完全なDOS）を引き起こす不正な能力が生じる可能性があります...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66491 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

EUVD-2026-54412

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

Arbitrary Code Execution

import-in-the-middle is vulnerable to Arbitrary Code Execution. The vulnerability exists due to the lack of sanitization in the getSource function of hook.js, which allows an attacker to inject and execute malicious code in the import function...

Improper Restriction of XML External Entity Reference in com.h2database:h2.

H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity XXE Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML method. If it...

GHSA-7RPJ-HG47-CX62 Improper Restriction of XML External Entity Reference in com.h2database:h2.

H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity XXE Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML method. If it...

CVE-2021-23463

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity XXE Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML method. If it executes the getSource method when the paramete...

PT-2021-8014 · H2Database · H2

Name of the Vulnerable Software and Affected Versions: com.h2database:h2 versions 1.4.198 through 2.0.202 Description: The issue is related to XML External Entity XXE Injection via the org.h2.jdbc.JdbcSQLXML class object. This occurs when the object receives parsed string data from the...

XML External Entity (XXE) Injection

Overview com.h2database:h2 is a database engine Affected versions of this package are vulnerable to XML External Entity XXE Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML method. If it executes the getSource meth...