PT-2026-120310

Summary When uploadfs is configured with the Azure backend and sas: true a supported configuration introduced in uploadfs 1.25.0, createContainer builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the getUrl process. An attacker can execute arbitrary JavaScript in the context of the affected site by injecting specially crafted input into the src attribute of an iframe, which is not properly sanitized...

CVE-2026-54507

Vvveb is a CMS with page builder. Prior to 1.0.8.5 , the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled URL parameter passed to getUrl(). The validateUrl() function in system/functions.php checks only the hostname string but does not validate resolved a...

PDF CVE-2017-10951 Foxit getURL Callback

Generate PDF PoC for CVE-2017-10951: Foxit Reader JavaScript this.getURL phone-home on document open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.javascript import writefoxitgeturljs class ModuleAuxiliary,...

Silverstripe Assets Module has a DBFile::getURL() permission bypass

Impact Images rendered in templates or otherwise accessed via DBFile::getURL or DBFile::getSourceURL incorrectly add an access grant to the current session, which bypasses file permissions. This usually happens when creating an image variant, for example using a manipulation method like ScaleWidt...

CVE-2026-24749 Silverstripe Assets Module has a DBFile::getURL() permission bypass

The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, images rendered in templates or otherwise accessed via DBFile::getURL or DBFile::getSourceURL incorrectly add an access grant to the current session, which...

CVE-2026-24749

The CVE concerns the SilverStripe Assets Module (required for SilverStripe Framework). In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, images rendered via templates or accessed with DBFile::getURL() or DBFile::getSourceURL() erroneously add an access grant to the current session, bypassin...

CVE-2026-24749

The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, images rendered in templates or otherwise accessed via DBFile::getURL or DBFile::getSourceURL incorrectly add an access grant to the current session, which...

CVE-2026-24749: Incorrect Authorization

The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, images rendered in templates or otherwise accessed via DBFile::getURL or DBFile::getSourceURL incorrectly add an access grant to the current session, which...

EUVD-2009-2382

Malware in sbrugna...

EUVD-2025-31380

Malicious code in bioql PyPI...

CVE-2025-6762 diyhi bbs HTTP Header login getUrl server-side request forgery

A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely...

CVE-2025-6762: Server-Side Request Forgery (SSRF)

A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely...

Diyhi BBS security vulnerabilities

diyhi bbs patrol cloud light forum system is a forum system for diyhi individual developers. A security vulnerability exists in diyhi bbs version 6.8 and earlier, which stems from improper manipulation of the Host parameter in the getUrl function of the HTTP header processing component, which cou...

CVE-2021-45980

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API...

CVE-2021-45980

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API...

CVE-2021-45980

Foxit PDF Reader and PDF Editor for macOS are affected by CVE-2021-45980 (pre-11.1). The vulnerability allows remote code execution through the getURL function in the JavaScript API. Exploitation details are not expanded beyond the remote code execution vector in the sources, so practical exploit...

Foxit PDF Reader injection vulnerability

Foxit PDF Reader is a PDF reader from the Chinese company Foxit. An injection vulnerability exists in Foxit PDF Reader and PDF Editor on macOS that allows remote attackers to execute arbitrary code via a getURL in the JavaScript API...

CVE-2021-45980: Undefined Security Weakness

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API...

PT-2022-12481

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader and PDF Editor versions prior to 11.1 Description The issue allows remote attackers to execute arbitrary code via getURL in the JavaScript API. This can be exploited to gain unauthorized access and control over the system...