CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

Drupal Plausible tracking is vulnerable to XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Plausible tracking allows Cross-Site Scripting XSS. This issue affects Plausible tracking: from 0.0.0 before 1.0.2...

PT-2025-44355

Name of the Vulnerable Software and Affected Versions Drupal Plausible tracking versions prior to 1.0.2 Description The Plausible tracking component contains a flaw due to improper input neutralization during web page generation, leading to a Cross-Site Scripting XSS issue. This allows for the...

CVE-2023-5375 Open Redirect in mosparo/mosparo

Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2...

CVE-2023-5375 Open Redirect in mosparo/mosparo

Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2...

PT-2023-27227 · Unknown · Woodpecker

Name of the Vulnerable Software and Affected Versions: Woodpecker versions prior to 1.0.2 Description: An attacker can post malformed webhook data which leads to an update of the repository data, potentially allowing the takeover of a repository. This issue is critical if the CI is configured for...

PT-2023-17226

Name of the Vulnerable Software and Affected Versions Akbim Computer Panon versions prior to 1.0.2 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations For versions prior to...