6 matches found
CVE-2026-56709
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...
CVE-2025-64744: Improper Neutralization of Input During Web Page Generation
OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is inserted into the email template without...
Cross-site Scripting (XSS)
passbolt/passboltapi is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input, allowing an attacker to inject malicious scripts into the user's first and last name fields, which execute when the setup link in the invitation email is accessed...
ToolJet Code Injection Vulnerability
A code injection vulnerability exists in ToolJet v0.6.0 through v1.10.2, which stems from a lack of data validation filtering of user-supplied data and output in the first and last name fields of the invitation email. An attacker could exploit this vulnerability to inject malicious code when...
ToolJet 跨站脚本漏洞
A code injection vulnerability exists in ToolJet v0.6.0 through v1.10.2, which stems from a lack of data validation filtering of user-supplied data and output in the first and last name fields of the invitation email. An attacker could exploit this vulnerability to inject malicious code when...
