Flowise-CVE-2025-58434-Chain-59528

Цепочка CVE FlowiseAI - ATO CVE-2025-58434 и RCE CVE-2025-59528 ⚠️ Только для образовательных целей и авторизованных исследований безопасности. Запуск этого инструмента против систем, которыми вы не владеете или на тестирование которых у вас нет письменного разрешения, незаконен. Содержание Этот...

CVE-2021-40513

CVE-2021-40513 OSCAR McMaster 19.401235 Уязвимость отраженного межсайтового скриптинга Уязвимость отраженного межсайтового скриптинга существует на нескольких страницах версии 19.401235 приложения OSCAR McMaster, которая позволяет произвольно выполнять команды JavaScript. Заполнитель для CVE mitr...

CVE-2026-104979: Improper Neutralization of Input During Web Page Generation

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

PT-2026-106058

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description html through Issue.objects.create... without calling validate html content from nh3. Any authenticated user, including a new user with no workspace memberships, can...

PT-2026-106026

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

PT-2026-104801

The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...

CVE-2026-105694: Improper Neutralization of Input During Web Page Generation

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-102295: Improper Neutralization of Input During Web Page Generation

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-59788: Improper Neutralization of Input During Web Page Generation

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2026-59782: Out-of-bounds Read

The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...

PT-2026-106215

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description Authenticated users with file-edit permissions can upload SVG media containing scripts, event-handler attributes, and foreignObject elements that are stored without sanitization and served as...

CVE-2026-102282: Incorrect Permission Assignment for Critical Resource

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

PT-2026-104806

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2024-33209

CVE-2024-33209 FlatPress 1.3은 XSSCross Site Scripting 취약점에 노출되어 있습니다. 공격자는 "Add New Entry" 섹션에 악성 JavaScript 코드를 삽입하여 피해자 웹 브라우저의 컨텍스트에서 임의 코드를 실행할 수 있습니다. 취약점 유형: Cross Site Scripting XSS 제품 공급업체 : flatpress CMS 영향을 받는 제품 코드 베이스 : Flatpress v1.3 - FlatPress 버전 1.3에서 수정될 예정입니다. 영향을 받는 구성 요소 관리자 패...

MAL-2026-17473 Malicious code in chai-as-testmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A...

Malicious code in chai-as-testmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A...

CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description

Quick CMS 저장형 XSS v6.7 저자: Sergio 설명: Quick CMS v6.7의 교차 사이트 스크립팅XSS 취약점으로 인해 로컬 공격자가 Pages 메뉴의 SEO - Meta description에 조작된 스크립트를 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: "Pages- SEO"의 Meta description 입력값 검증 취약점으로 인해 사용자가 웹 페이지에 접속할 때 실행되는 JavaScript 코드를 삽입할 수 있습니다. PoC: 패널에 로그인하면 일반 메뉴의 "Pages - SEO" 섹션으로...

CVE-2023-31703

CVE-2023-31703 — eScan Management Console의 반사형 XSS 개요 CVE ID: CVE-2023-31703 취약점 유형: 반사형 크로스 사이트 스크립팅XSS 영향받는 제품: Microworld Technologies eScan Management Console 영향받는 버전: 14.0.1400.2281 심각도: 중간 발견자: Sahil Ojha 공개 날짜: 2023년 5월 16일 설명 Microworld Technologies eScan Management Console버전...

CVE-2023-33829

CVE-2023-33829: Stored-XSS-on-SCM-Manager-1.60 요약 SCM Manager 1.2 = 1.60 버전에서 취약점이 발견되었습니다. 이 취약점으로 인해 쓰기 권한으로 사전 인증된 공격자가 특정 필드에서 javascript 코드를 실행할 수 있습니다. 이 개념 증명PoC은 docker를 사용하여 SCM Manager 1.60을 로컬 환경에 배포하여 만들어졌습니다. CVE 공개:...

CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - "firstname" 필드/매개변수의 Cross-Site Scripting XSS 취약점 "customerlist" 페이지 설명 : Customer Support System 1.0은 저장형 XSS에 취약합니다. Customer Support System 버전 1에 XSS 취약점이 존재합니다. 악의적인 공격자는 고객 편집/생성 시 "firstname" 필드/매개변수를 통해 JavaScript 코드를 삽입할 수 있습니다. 이 코드는...