cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - Control de Acceso Roto en el Parámetro Nick de EditUser en FacturaScripts Descripción Resumen La aplicación no valida el parámetro nick durante una solicitud POST al controlador EditUser. Aunque la interfaz de usuario impide editar este campo, un usuario puede omitir esta...

CVE-2026-32699

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...

EUVD-2026-27438

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...

CVE-2026-32699

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...

CVE-2026-32699: External Control of Assumed-Immutable Web Parameter

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass through improper validation of the nick parameter in the user update process. An attacker can modify immutable account identifiers by intercepting and altering POST requests, potentially sabotaging audit trails,...

EUVD-2005-3235

Malware in sbrugna...

EUVD-2022-1658

Malicious code in bioql PyPI...

CVE-2025-51403

A stored cross-site scripting XSS vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter...

CVE-2025-51403

Live Helper Chat versions v4.60 and v4.61 are vulnerable to a stored cross-site scripting (XSS) flaw in the department assignment editing module. The root cause is the insufficient validation and lack of sanitization for the Alias Nick parameter. A low-privileged user can inject a malicious JavaS...

CVE-2025-51403: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter...

CVE-2025-51403

A stored cross-site scripting XSS vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter...

CVE-2020-28847

Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment...

GHSA-6XVQ-2GJ8-4276 Cross site scripting in valine

valine is a fast, simple & powerful comment system. Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. A fix was released in version 1.4.15...

CVE-2020-28847

Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment...

CVE-2020-28847: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment...

Valine 跨站脚本漏洞

Valine is a commenting system. A cross-site scripting vulnerability exists in Valine version 1.4.14, which originates from sending to /classes/Comment via the nick parameter...

CVE-2018-19927

Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...

Cross site scripting

Cross-site scripting XSS vulnerability in profilo.php in Happy Chat 1.0 allows remote attackers to inject arbitrary web script or HTML via the nick parameter...

CVE-2011-5296: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in profilo.php in Happy Chat 1.0 allows remote attackers to inject arbitrary web script or HTML via the nick parameter...