23461 matches found
CVE-2025-69241 Stored XSS in Raytha CMS
Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...
CVE-2025-69241
Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...
CVE-2025-69241 Stored XSS in Raytha CMS
Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...
CVE-2026-3111 Multiple vulnerabilities on the Educativa Campus
Insecure Direct Object Reference IDOR vulnerability in Campus Educativa specifically at the endpoint '/archivos/usuarios/ID/username/thumbAAxAA.jpg' translated as 80x90 and 40x45. Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the profile photos of...
CVE-2026-3111
CVE-2026-3111 affects Educativa Campus. An Insecure Direct Object Reference permits an unauthenticated attacker to access any user’s profile photo via the manipulated URL /archivos/usuarios/[ID]/[username]/thumb_AAxAA.jpg (80x90 and 40x45). The provided metrics state CVSS v4 base score 6.9 (Netwo...
CVE-2026-3111 Multiple vulnerabilities on the Educativa Campus
Insecure Direct Object Reference IDOR vulnerability in Campus Educativa specifically at the endpoint '/archivos/usuarios/ID/username/thumbAAxAA.jpg' translated as 80x90 and 40x45. Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the profile photos of...
CVE-2026-32938
creationtimestamp| type| source ---|---|--- 2026-03-16 02:17:17+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fq2j-j8hc-8vw8 2026-03-20 23:15:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjni77rwp2k 2026-03-21...
INDEX ÉDUCATION PRONOTE 安全漏洞
INDEX ÉDUCATION PRONOTE is an educational management platform developed by the French company INDEX ÉDUCATION. Versions of INDEX ÉDUCATION PRONOTE prior to version 2025.2.8 contained security vulnerabilities. These vulnerabilities were due to improper access control, which could allow unverified...
CVE-2025-69727
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components index.js and composeUrlImgPhotoIndividu allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to...
CVE-2025-69727
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components index.js and composeUrlImgPhotoIndividu allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to...
PT-2026-25694
Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...
educativa Campus Educativa 访问控制错误漏洞
Educativa Campus Educativa is an educational management platform owned by the Spanish company Educativa. Educativa Campus Educativa has a security vulnerability related to access control. This vulnerability stems from an insecure direct object reference in the file...
CVE-2025-69727
CVE-2025-69727 affects INDEX-EDUCATION PRONOTE
PT-2026-25793
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components index.js and composeUrlImgPhotoIndividu allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to...
Raytha CMS 跨站脚本漏洞
Raytha CMS is a content management system developed by the American company Raytha. Versions of Raytha CMS prior to 1.4.6 contained a cross-site scripting vulnerability. This vulnerability stemmed from the FirstName and LastName parameters in the profile editing function, which allowed for stored...
CVE-2026-4191
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...
CVE-2026-4191 JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...
CVE-2026-4191
CVE-2026-4191 affects JawherKl node-api-postgres (up to v2.5). The Profile Picture Handler’s index.js path.extname function is manipulated, causing unrestricted upload. Attack is remote and exploit has been published; vendor did not respond. No remediation details are provided in the supplied doc...
CVE-2026-4191 JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...
CVE-2026-28498
creationtimestamp| type| source ---|---|--- 2026-03-15 17:48:43+00:00| published-proof-of-concept| https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j 2026-03-18 23:00:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mheloq2uhh2h...