CVE-2026-75887 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

External Control of File Name or Path

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to External Control of File Name or Path via the ns parameter in plugins/sql-log.php. An attacker can write arbitrary .sql files with attacker-controlled content to any writable...

CVE-2026-34967

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled conte...

CVE-2026-34967

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences to write arbitrary .sql files with attacker-controlled content to any writable d...

CVE-2026-34967 Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled conte...

CVE-2026-34967: External Control of File Name or Path

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled conte...

Prototype Pollution

Overview i18next-http-middleware is an i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Affected versions of this package are vulnerable to Prototype Pollution via the lng or ns parameters handled by the getResourcesHandler...

EUVD-2009-4845

Malware in sbrugna...

EUVD-2012-0319

Malware in sbrugna...

PT-2016-1281

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.4 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Java Proxy Runtime ProxyServer servlet. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via t...

CVE-2014-8762

The ajaxmediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter...

CVE-2014-8762

The ajaxmediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter...

PT-2014-8717

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2014-05-05a Description The issue allows remote attackers to access arbitrary images through a manipulated namespace in the ns parameter of the ajax mediadiff function. Recommendations For versions prior to...

CVE-2014-8762: Exposure of Sensitive Information to an Unauthorized Actor

The ajaxmediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter...

CVE-2012-0283

Cross-site scripting XSS vulnerability in the tplmediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php...

DEBIAN-CVE-2012-0283

Cross-site scripting XSS vulnerability in the tplmediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php...

CVE-2012-0283

Cross-site scripting XSS vulnerability in the tplmediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php...

PT-2012-2460

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2012-01-25b Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the ns parameter in a medialist action to "lib/exe/ajax.php"...

CVE-2012-0283: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the tplmediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in zc/publisher/html.rb in ZoneCheck 2.0.4-13 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the ns parameter to zc.cgi...