CVE-2026-55442 Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery strips Solr local-parameter syntax !... from user-supplied query strings before they reach Solr. Its regex can be bypassed by...

CVE-2026-55442 Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery strips Solr local-parameter syntax !... from user-supplied query strings before they reach Solr. Its regex can be bypassed by...

CVE-2026-55442 Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery strips Solr local-parameter syntax !... from user-supplied query strings before they reach Solr. Its regex can be bypassed by...

CVE-2026-55442

The Goobi viewer web application (versions 23.03 to before 26.05 ) contains a vulnerability in the SolrTools.cleanUpQuery() shared sanitizer. The flaw allows for arbitrary Solr local-parameter injection because the regex used to strip local-parameter syntax ({!...}) can be bypassed by wrapping th...

CVE-2026-17571

The CVE-2026-17571 entry covers the Fluent Forms WordPress plugin (versions up to 6.2.8). The vulnerability is a Reflected Cross-Site Scripting flaw via the ‘param’ parameter caused by insufficient input sanitization and output escaping. It could allow unauthenticated attackers to craft pages tha...

Accellion FTA Device Cross-Site Scripting Vulnerability (CNVD-2017-07450)

Accellion FTA devices is a file transfer device from Accellion USA. The device supports file transfer, file sharing, file transfer tracking and reporting, and more. A cross-site scripting vulnerability exists in home/seos/courier/smtpgadd.html in Accellion FTA devices versions prior to FTA912180....