CVE-2024-5926

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service DoS. This issue is present in all versions of the application. The vulnerability arises due to insufficient path...

CVE-2025-22606

CVE-2025-22606 describes a command-injection vulnerability in Coolify caused by unsafely handling project names in versions up to 4.0.0-beta.358 (likely earlier). An attacker with access to project management could inject arbitrary shell commands by including unescaped characters (e.g., a single ...

CVE-2025-22606 Coolify Command Injection Vulnerability in Project Name

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

PT-2025-4592 · Coolify · Coolify

Name of the Vulnerable Software and Affected Versions: Coolify versions 4.0.0-beta.358 and earlier Description: The issue allows attackers to inject arbitrary shell commands by altering the project name, potentially resulting in full system compromise, creation, modification, or deletion of...

CVE-2024-56314

A stored cross-site scripting XSS vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the project name to access it, the crafted payload is executed, potentially enabling the...

PT-2024-36785 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions prior to 15.0.0 Description: A stored cross-site scripting XSS vulnerability in the Project name of REDCap allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the...

CVE-2024-56314

REDCap versions prior to 15.0.0 (including through 14.9.6 ) are vulnerable to a stored cross-site scripting (XSS) vulnerability in the Project name field. The root cause is the system's failure to effectively neutralize input content in this field, allowing authenticated users to inject malicious...

CVE-2024-54155

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication...

ABB Cylon Aspect 3.08.01 getApplicationNamesJS.php Building/Project Name Exposure

ABB Cylon Aspect 3.08.01 getApplicationNamesJS.php Building/Project Name Exposure Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building...

The vulnerability of the IntelliJ IDEA integrated development environment lies in its lack of protection for web page structures. This allows attackers to execute cross-site scripting attacks by modifying the project name.

The vulnerability of the IntelliJ IDEA integrated development environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability may allow attackers to execute cross-site scripting attacks...

CVE-2024-46970

In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible...

CVE-2024-46970

In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible...

CVE-2024-46970

In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible...

CVE-2024-46970

JetBrains IntelliJ IDEA versions prior to 2024.1 are affected by a cross-site scripting risk due to HTML injection via the project name. The root cause is inadequate protection of the web page structure allowing HTML injection in the project name. Impact is described as HTML injection/XSS in mult...

CVE-2024-46970

In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible...

PT-2024-6311 · Jetbrains · Jetbrains Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2024.1 Description: The issue is related to the lack of protection of the web page structure in the integrated development environment, allowing for HTML injection via the project name. This could...

JetBrains IntelliJ IDEA 跨站脚本漏洞

JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from the Czech company JetBrains. A cross-site scripting vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2024.1, which stems from the ability to perform HTML injection via project name...

The vulnerability of the Jenkins Git Matrix Project plugin, related to incorrect restrictions on the path to the restricted access directory, allows attackers to compromise the integrity of the protected information.

The vulnerability of the Jenkins Git Matrix Project plugin is related to the lack of cleaning of user-defined project names with multiple configurations. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

CVE-2024-25218

A cross-site scripting XSS vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php...

CVE-2024-25218

A cross-site scripting XSS vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php...