50 matches found
PT-2026-77285
Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3 Description An issue exists in the CertificateExport process where the ownership check for CertificatePermission was incorrectly placed within the plugin.requires key branch for the 'POST...
CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...
CVE-2026-61456 Grav before 1.0.3 Stored XSS via SVG Upload API
The Grav API plugin getgrav/grav-plugin-api before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile method validates only the file extension and never invokes Security::sanitizeSVG, so an authenticated attacker with t...
PT-2026-49310
An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request...
CVE-2026-38329
Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...
CVE-2026-38329
Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...
[SECURITY] Fedora 43 Update: nextcloud-33.0.4-1.fc43
NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...
CVE-2026-4646
Mattermost has an input-validation flaw in the API request handlers used by the PR details endpoint. Affected versions are 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x
EUVD-2021-34783
AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering JavaScript payloads into the 'icon title' field. Attackers can store XSS payloads like image tags with onerror event handlers that execut...
PT-2026-39497
AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering JavaScript payloads into the 'icon title' field. Attackers can store XSS payloads like image tags with onerror event handlers that execut...
CVE-2026-24047 @backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...
CVE-2025-64114 ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin
ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - 151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom...
PT-2025-37257
Name of the Vulnerable Software and Affected Versions: AIRI versions 0.7.2-beta.2 Description: AIRI is a self-hosted, artificial intelligence based Grok Companion. The application processes Markdown content using the useMarkdown composable and renders it directly into the DOM using v-html. An...
CVE-2024-58104
A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the...
WordPress plugin Interface security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
io.dataease:dataease-plugin-datasource (>=1.10.0, <=1.18.9), io.dataease:dataease-plugin-interface (>=1.0, <=1.18.9) +1 more potentially affected by CVE-2023-40771 via io.dataease:dataease-plugin-common (>=1.0, <=1.18.9)
io.dataease:dataease-plugin-common MAVEN version =1.0, =1.10.0, =1.0, =1.8.0, =1.18.9 Source cves: CVE-2023-40771 Source advisory: GHSA-8RV7-G772-PP3J...
io.dataease:dataease-plugin-datasource (>=1.10.0, <=1.18.9), io.dataease:dataease-plugin-interface (>=1.0, <=1.18.9) +1 more potentially affected by CVE-2023-40771 via io.dataease:dataease-plugin-common (>=1.0, <=1.18.9)
io.dataease:dataease-plugin-common MAVEN version =1.0, =1.10.0, =1.0, =1.8.0, =1.18.9 Source cves: CVE-2023-40771 Source advisory: OSV:GHSA-8RV7-G772-PP3J...
io.dataease:dataease-plugin-datasource (>=1.10.0, <=1.18.6), io.dataease:dataease-plugin-interface (>=1.0, <=1.18.6) +1 more potentially affected by CVE-2023-32310 via io.dataease:dataease-plugin-common (>=1.0, <=1.18.6)
io.dataease:dataease-plugin-common MAVEN version =1.0, =1.10.0, =1.0, =1.8.0, =1.18.6 Source cves: CVE-2023-32310 Source advisory: OSV:GHSA-7HV6-GV38-78WJ...
io.dataease:dataease-plugin-datasource (>=1.10.0, <=1.18.6), io.dataease:dataease-plugin-interface (>=1.0, <=1.18.6) +1 more potentially affected by CVE-2023-32310 via io.dataease:dataease-plugin-common (>=1.0, <=1.18.6)
io.dataease:dataease-plugin-common MAVEN version =1.0, =1.10.0, =1.0, =1.8.0, =1.18.6 Source cves: CVE-2023-32310 Source advisory: GHSA-7HV6-GV38-78WJ...
io.dataease:dataease-plugin-datasource (>=1.10.0, <=1.18.6), io.dataease:dataease-plugin-interface (>=1.0, <=1.18.6) +1 more potentially affected by CVE-2023-32310 via io.dataease:dataease-plugin-common (>=1.0, <=1.18.6)
io.dataease:dataease-plugin-common MAVEN version =1.0, =1.10.0, =1.0, =1.8.0, =1.18.6 Source cves: CVE-2023-32310 Source advisory: MEND:CVE-2023-32310...