CVE-2026-108554

PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...

EUVD-2026-96348

PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...

CVE-2026-108554 PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input

PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...

CVE-2026-108554

The software PDFMathTranslate (pdf2zh) versions through 1.9.11 is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists within the translate_file handler, which fails to perform scheme or address validation on URLs provided via the Link input of the Gradio Web GUI. This allows unau...

CVE-2026-108554 PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input

PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...

PT-2026-109668

Name of the Vulnerable Software and Affected Versions PDFMathTranslate pdf2zh versions prior to 1.9.12 Description An unauthenticated attacker can perform a server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended location. The issue exists...

CVE-2026-108554: Server-Side Request Forgery (SSRF)

PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...

PT-2026-38893

Name of the Vulnerable Software and Affected Versions Auto Affiliate Links versions prior to 6.8.9 Description The plugin is subject to Stored Cross-Site Scripting due to insufficient input sanitization of the url POST parameter within the aal url stats save action function and a lack of output...

EUVD-2020-30884

docPrint Pro 8.0 contains a local buffer overflow vulnerability in the 'Add URL' input field that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload that triggers a structured exception handler SEH overwrite to execute shellcode and gain remo...

EUVD-2025-201879

@tiptap/extension-link vulnerable to Cross-site Scripting XSS...

CVE-2025-14284

Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting XSS due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload in...

Linux Distros Unpatched Vulnerability : CVE-2024-22262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the...

PT-2025-33738 · Moonshine · Moonshine

Name of the Vulnerable Software and Affected Versions: MoonShine version 3.12.3 Description: A stored cross-site scripting XSS vulnerability exists in the Create Article function. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the Link parameter...

WordPress plugin Team Members has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

SUSE CVE-2018-18607

An issue was discovered in elflinkinputbfd in elflink.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elflinkinputbfd when used for finding STTTLS symbols without any TLS section. A specially crafted ELF allows...

Improper Link Input Validation leads to Cross-site Scripting (XSS)

Description The link input validation is not filtered protocol javascript of href attribute. It allows attackers to inject malicious links to many fields of the website, such as author introduction, user summary, and book description, ... which could execute javascript code XSS. Proof of Concept...

WS-2022-0223

Improper Link Input Validation leads to Cross-site Scripting XSS in bookwyrm-social/bookwyrm before 0.4.1...

Cross-site Scripting (XSS)

Overview typo3/cms is a free open source Content Management Framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the typoLink function. An attacker can inject arbitrary web script or HTML by crafting malicious input in a link field. Note: This is only...

PT-2018-2447

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.31 Description The issue is related to a null pointer dereference in the elf link input bfd function when searching for STT TLS symbols without any TLS section. This can be exploited by remote attackers to cause a denial...

CVE-2018-10365: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the option to convert the thread to a link. The thread link input box is not properly sanitized...