PT-2026-91116

Publishing limits the compressed size of a VSIX ovsx.publishing.max-content-size, 512 MB by default but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/namespace/extension/version/path, WebResourceService opened the entry with ZipFile.getInputStream a...

CVE-2026-36766

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

GHSA-FQCW-2XHJ-P63G Shopizer is vulnerable to Cross-site Scripting

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer through version 3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

Shopizer is vulnerable to Cross-site Scripting

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer through version 3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

CVE-2026-36766

The shopizer open-source e-commerce solution, specifically version v3.2.5 , contains multiple authenticated cross-site scripting (XSS) vulnerabilities within the XssHttpServletRequestWrapper class. The root cause is the improper neutralization of input, which allows an authenticated attacker to i...

Shopizer 跨站脚本漏洞

Shopizer is an open-source e-commerce solution developed by the Shopizer team, based on Java. Version 3.2.5 of Shopizer contains a cross-site scripting vulnerability. This vulnerability stems from the XssHttpServletRequestWrapper class, which has multiple authenticated cross-site scripting...

CVE-2026-36766: Improper Neutralization of Input During Web Page Generation

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

CVE-2025-13805

A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the component LiteRpc-Serializer. Executing a...

CVE-2025-13805

CVE-2025-13805 affects nutzam NutzBoot up to 2.6.0-SNAPSHOT via the LiteRpc-Serializer’s HttpServletRpcEndpoint.getInputStream, enabling deserialization of untrusted data. Described as remote and high-complexity, with exploit code publicly available. No fixed version is identified; monitoring for...

NutzBoot 代码问题漏洞

NutzBoot is an enterprise microservices framework open-sourced by Nutz. A code issue vulnerability exists in NutzBoot 2.6.0-SNAPSHOT and earlier versions, which stems from a misbehavior of the function getInputStream in the file HttpServletRpcEndpoint.java, which could lead to deserialization...