44532 matches found
PT-2026-89185
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument pro name results in sql injection. The...
PT-2026-89042
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...
PT-2026-88818
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-79692: External Control of File Name or Path
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access...
PT-2026-89041
Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...
mongodb: Reject "." and NUL bytes in database and collection names
Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. Patches Fixed in PHP library 1.21.4 and 2.4.1. Workarounds Validate database and collection names prior to passing into APIs...
GHSA-65FR-J4P9-VC33 mongodb: Reject "." and NUL bytes in database and collection names
Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. Patches Fixed in PHP library 1.21.4 and 2.4.1. Workarounds Validate database and collection names prior to passing into APIs...
EUVD-2026-69241
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator...
GHSA-JXJR-3G7G-3944 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
Summary An embedded line terminator bypasses the requireWellFormed serializer check for element and attribute names. The check was added to fix GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm; a name whose first line is well-formed slips past it and is serialized verbatim, so the characters after the...
xmldom: DocType `name` Injection Bypasses requireWellFormed
Summary The @xmldom/xmldom serializer emits DocumentType.name verbatim into the declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h CVE-2026-41674 hardened the serializer's requireWellFormed path for a DocumentType's sibling fields — publicId, systemId, and internalSubset — but it did...
GHSA-27P8-2357-5QQV xmldom: DocType `name` Injection Bypasses requireWellFormed
Summary The @xmldom/xmldom serializer emits DocumentType.name verbatim into the declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h CVE-2026-41674 hardened the serializer's requireWellFormed path for a DocumentType's sibling fields — publicId, systemId, and internalSubset — but it did...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the store process. An attacker can overwrite arbitrary existing files writable by the PHP process with partially controlled content by supplying a crafted export path, potentially leading to...
EUVD-2026-69217
xmldom: Element name injection via createElement bypasses requireWellFormed...
GHSA-W2RR-34G9-RVRJ xmldom: Element name injection via createElement() bypasses requireWellFormed
Summary Document.createElement in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the requireWellFormed: true serializer option — the recommended mitigation from CVE-2026-41672,...
NPM: xmldom: Element name injection via createElement() bypasses requireWellFormed
NPM: xmldom: Element name injection via createElement bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
GHSA-4W3W-2RP5-G8JM xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...
CVE-2026-81192 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...
