136 matches found
CVE-2026-35571 Emissary has Stored XSS via Navigation Template Link Injection
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript:...
CVE-2026-35571
CVE-2026-35571 affects Emissary prior to 8.39.0. Mustache navigation templates interpolated config-controlled link values directly into href attributes without URL scheme validation, allowing an administrator with navItems access to inject javascript: URIs and trigger stored XSS against other aut...
NocoDB has Stored Cross-site Scripting via Formula Cell
Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI:: patterns are rendered via v-html without sanitization, allowing injected HTML to execute. Details The replaceUrlsWithLink function in urlUtils.ts converts URI::url patterns to tags but passes a...
CVE-2026-27593
Statamic CMS (Laravel/Git-based) is affected by CVE-2026-27593 via a password-reset vulnerability. Prior to versions 6.3.3 and 5.73.10, an attacker who knows a valid account’s email could capture a reset token and reset the password on behalf of the user, who must click the reset link in their em...
GHSA-JXQ9-79VJ-RGVW Statamic is vulnerable to account takeover via password reset link injection
Impact An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they...
Statamic is vulnerable to account takeover via password reset link injection
Impact An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they...
CVE-2024-39863
Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...
pretix has Email Content Injection Through Maliciously Formatted Names
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when name is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML i...
EUVD-2017-10568
Malware in sbrugna...
EUVD-2014-3032
Malware in sbrugna...
EUVD-2013-5251
Malware in sbrugna...
EUVD-2014-1000
Malware in sbrugna...
EUVD-2010-2334
Malware in sbrugna...
EUVD-2021-16150
Malware in sbrugna...
EUVD-2021-19355
Malware in sbrugna...
EUVD-2013-6135
Malware in sbrugna...
EUVD-2025-21019
Malicious code in bioql PyPI...
EUVD-2022-3263
Malicious code in bioql PyPI...