30 matches found
EUVD-2026-72670
NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...
CVE-2026-86550
NuBrowser , a ZTE browser product, contains a universal cross-site scripting (UXSS) vulnerability (CVE-2026-86550). The root cause is a missing protocol whitelist validation on the S.browser_fallback_url field of intent:// URIs, which allows an attacker to inject javascript: URLs via 302 redirect...
CVE-2026-86550 UXSS vulnerability in ZTE browser products
NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...
CVE-2026-3189
A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. Attacks ...
CVE-2026-3189 feiyuchuixue sz-boot-parent download server-side request forgery
A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. Attacks ...
CVE-2026-3189
Feiyuchuixue sz-boot-parent up to 1.3.2-beta contains a server-side request forgery (SSRF) via the url parameter in the /api/admin/common/files/download endpoint. The issue can be exploited remotely and stems from inadequate validation; upgrade to 1.3.3-beta. The patch aefaabfd7527188bfba3c8c9eee...
CVE-2026-3189 feiyuchuixue sz-boot-parent download server-side request forgery
A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. Attacks ...
PT-2026-21944
Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions through 1.3.2-beta Description A weakness exists in feiyuchuixue sz-boot-parent up to version 1.3.2-beta. This issue affects unknown code within the /api/admin/common/files/download file. Manipulation of th...
Linux Distros Unpatched Vulnerability : CVE-2018-6360
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and...
CVE-2023-37535
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters...
CVE-2023-37535
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters...
CVE-2023-37535 HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters...
CVE-2023-37535 HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters...
CVE-2023-37535: Improper Neutralization of Input During Web Page Generation
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters...
CVE-2023-37534
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...
CVE-2023-37534 HCL Leap is affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...
CVE-2023-37534 HCL Leap is affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...
PT-2025-17842
Name of the Vulnerable Software and Affected Versions HCL Leap affected versions not specified Description The issue is related to an insufficient URI protocol whitelist, which allows script injection through query parameters. Recommendations At the moment, there is no information about a newer...
SUSE CVE-2018-6360
mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. For example, an av://lavfi:ladspa=file= UR...
mpv: Remote code execution
Background Video player based on MPlayer/mplayer2 Description A vulnerability was discovered in mpv with the handling of HTML documents containing VIDEO elements. Additionally, mpv accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. Impact A remote...