CVE-2021-40513

CVE-2021-40513 OSCAR McMaster 19.401235 반사형 크로스 사이트 스크립팅 취약점 OSCAR McMaster 애플리케이션 19.401235 버전의 여러 페이지에는 임의의 JavaScript 명령을 실행할 수 있는 반사형 크로스 사이트 스크립팅 취약점이 존재합니다. CVE mitre 자리 표시자 취약한 JSP 페이지: documentReport.jsp - functionid, function, curUser 매개변수 addappointment.jsp - duration, endtime, starttim...

CVE-2026-104979: Improper Neutralization of Input During Web Page Generation

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

PT-2026-106058

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description html through Issue.objects.create... without calling validate html content from nh3. Any authenticated user, including a new user with no workspace memberships, can...

PT-2026-106026

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

PT-2026-104801

The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...

CVE-2026-105694: Improper Neutralization of Input During Web Page Generation

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-102295: Improper Neutralization of Input During Web Page Generation

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-59788: Improper Neutralization of Input During Web Page Generation

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2026-59782: Out-of-bounds Read

The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...

PT-2026-106215

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description Authenticated users with file-edit permissions can upload SVG media containing scripts, event-handler attributes, and foreignObject elements that are stored without sanitization and served as...

PT-2026-104806

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2026-102282: Incorrect Permission Assignment for Critical Resource

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2024-33209

CVE-2024-33209 FlatPress 1.3. 存在跨站脚本漏洞（XSS）。攻击者可以在“添加新条目”部分注入恶意的 JavaScript 代码，从而允许他们在受害者 Web 浏览器的上下文中执行任意代码。 漏洞类型： 跨站脚本（XSS） 产品供应商： flatpress CMS 受影响的产品代码库： Flatpress v1.3 - 将在 FlatPress 1.3 版本中修复。 受影响组件 管理面板中的“添加新条目”功能 攻击类型： 远程 影响： 利用此漏洞的攻击者可以向 FlatPress CMS 注入恶意代码，从而导致各种恶意活动，例如窃取用户会话令牌、cookie...

MAL-2026-17473 Malicious code in chai-as-testmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A...

Malicious code in chai-as-testmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A...

CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description

Quick CMS 저장형 XSS v6.7 저자: Sergio 설명: Quick CMS v6.7의 교차 사이트 스크립팅XSS 취약점으로 인해 로컬 공격자가 Pages 메뉴의 SEO - Meta description에 조작된 스크립트를 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: "Pages- SEO"의 Meta description 입력값 검증 취약점으로 인해 사용자가 웹 페이지에 접속할 때 실행되는 JavaScript 코드를 삽입할 수 있습니다. PoC: 패널에 로그인하면 일반 메뉴의 "Pages - SEO" 섹션으로...

CVE-2023-31703

CVE-2023-31703 — eScan Management Console의 반사형 XSS 개요 CVE ID: CVE-2023-31703 취약점 유형: 반사형 크로스 사이트 스크립팅XSS 영향받는 제품: Microworld Technologies eScan Management Console 영향받는 버전: 14.0.1400.2281 심각도: 중간 발견자: Sahil Ojha 공개 날짜: 2023년 5월 16일 설명 Microworld Technologies eScan Management Console버전...

CVE-2023-33829

CVE-2023-33829: Stored-XSS-on-SCM-Manager-1.60 概要 SCM Manager 1.2 = 1.60 バージョンに脆弱性が発見されました。書き込み権限を持つ認証済みの攻撃者が、特定のフィールドで JavaScript コードを実行できるようになります。 この Proof of Concept は、docker を使用して SCM Manager 1.60 をデプロイしたローカル環境で作成されました。 CVE 公開情報:...

CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - "firstname" 필드/매개변수의 Cross-Site Scripting XSS 취약점 "customerlist" 페이지 설명 : Customer Support System 1.0은 저장형 XSS에 취약합니다. Customer Support System 버전 1에 XSS 취약점이 존재합니다. 악의적인 공격자는 고객 편집/생성 시 "firstname" 필드/매개변수를 통해 JavaScript 코드를 삽입할 수 있습니다. 이 코드는...

CVE-2023-43342-Quick-CMS-Stored-XSS---Languages-Frontend

Quick CMS 저장 XSS v6.7 작성자: Sergio 설명: Quick CMS v6.7의 XSS교차 사이트 스크립팅 취약점으로 인해 로컬 공격자가 언어 메뉴의 프론트 및 백엔드 - 페이지에 조작된 스크립트를 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: 스크립팅 - '언어 - 프론트 및 백엔드' 페이지의 입력값 필터링 취약점으로 인해 사용자가 웹 페이지에 접근할 때 실행될 JavaScript 코드를 주입할 수 있습니다. POC: 패널에 로그인한 후, 일반 메뉴에서 '언어 - 프론트 및 백엔드' 섹션으로 이동합니다...