3114 matches found
CVE-2026-70557 diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts
diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...
CVE-2026-70557
The connected documents confirm a concrete vulnerability in diboot-core: POST /common/load-related-data allows an authenticated user to resolve any caller-supplied field name to any @TableField column across all entities and return those values, because there is no field or entity allowlist and r...
CVE-2026-70557 diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts
diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...
MAL-2026-12473 Malicious code in table-ui-new (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a [email protected] ships dist/config.js, exposed via the package.json ./config subpath export, which exports a module-level array named HASHES...
Malicious code in table-ui-new (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a [email protected] ships dist/config.js, exposed via the package.json ./config subpath export, which exports a module-level array named HASHES...
CVE-2026-71292
CVE-2026-71292 affects Subrion CMS. The admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, accepts a sort parameter by falling back to the attacker-controlled GET value when the key isn’t in the per-controller $_gridSorting whitelist. The value is then ...
EUVD-2026-53377
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the dir ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied sort GET parameter whenever the requested key is not present in the per-controller...
CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering
DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...
CVE-2026-71239
DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...
CVE-2026-70590
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...
Ghost: Blind Password Hash Disclosure in Ghost Admin API
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...
CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...
CVE-2026-70590
Ghost CMS (Node.js) prior to version 6.54.1 allowed staff-level users to leak other staff password hashes via the Ghost Admin API. The underlying issue is exposure of authentication data, enabling offline password guessing with potential account takeover; however, Device Verification was noted as...
CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...
CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl
Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...
EUVD-2026-52674
Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...
CVE-2026-39931
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...
CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...
CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...