CVE-2026-90872

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

CVE-2026-90872 Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

CVE-2026-90872 Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

EUVD-2026-113184

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

CVE-2026-90872

Progress Software WS_FTP Server on Windows (versions prior to 2024.0.7 and 2025.0.4 ) is vulnerable to an improper neutralization of directives in dynamically evaluated code within the Manager web console . This flaw allows an authenticated Manager administrator to execute arbitrary commands with...

Progress Software WS_FTP Server code injection vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.7 and 2025.0.4 contain a code injection vulnerability. This vulnerability stems from improper handling of dynamic code evaluation instructions within the Manager Web console, potentially allowing authenticated Manager administrators to execu...

CVE-2026-90872: Progress Software WS_FTP Server: Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software…

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

PT-2026-132377

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS FTP...

CVE-2026-64827

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in setenv.php where the redirectToLoginAdminIRequestHaveAccessToken function derives the current page name from PHPSELF and skips authentication when the value...

Liferay Portal - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...

CVE-2026-35267

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager...

CVE-2026-31192: Improper Input Validation

Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request...

CVE-2026-5214

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function...

CVE-2025-41726 Beckhoff: Arbitrary code execution within privileged processes

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes...

CVE-2025-41728: Out-of-bounds Read

A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager web service that cause an out-of-bounds read operation under certain circumstances due to ASLR and thereby potentially...

EUVD-2012-0751

Malware in sbrugna...

EUVD-2017-15071

Malware in sbrugna...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the Manager web UI endpoints /api/v1/jobs and /preheats. An attacker can gain unauthorized access to create, delete, or modify jobs, and initiate preheat jobs by sending unauthenticated requests to these...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the Manager web UI endpoints /api/v1/jobs and /preheats. An attacker can gain unauthorized access to create, delete, or modify jobs, and initiate preheat jobs by sending unauthenticated requests to these...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the Manager web UI endpoints /api/v1/jobs and /preheats. An attacker can gain unauthorized access to create, delete, or modify jobs, and initiate preheat jobs by sending unauthenticated requests to these...