CVE-2026-48539

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

EUVD-2026-48298

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

CVE-2026-48539 GFI Archiver < 15.13 Stored XSS via MailInsights.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

CVE-2026-48539

GFI Archiver prior to 15.13 is affected by CVE-2026-48539: a stored XSS in the MailInsights.aspx report naming parameter. An authenticated user can inject script/HTML that is stored by ReportScheduling.btnSaveReport_Click() and later executes in the viewer’s browser when they access the MailInsig...

EUVD-2024-16872

Malicious code in bioql PyPI...

CVE-2024-1097

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097 Stored XSS in craigk5n/webcalendar

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097 Stored XSS in craigk5n/webcalendar

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097

CVE-2024-1097: A stored XSS in craigk5n/webcalendar 1.3.0 occurs in the Report Name input during report creation. Malicious scripts can run in other users’ context, potentially enabling theft of user accounts and cookies. Public details about a fix are not provided in the connected sources; no pa...

PT-2024-16673 · Craigk5N · Webcalendar

Name of the Vulnerable Software and Affected Versions: craigk5n/webcalendar version 1.3.0 Description: A stored cross-site scripting XSS issue exists in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of...

Malicious code in report_name (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-24015

A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on...

Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2

Summary A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. Impact The reports section will be partially unavailable for all later attempts to use it, with the report list...

Acronis Cyber Protect Injection Vulnerability

Acronis Cyber Protect is an application. that provides unified protection for your network by integrating backup, disaster recovery, artificial intelligence-based malware protection, remote assistance and security into a single, reliable tool.Acronis Cyber Protect 15 Linux, Windows suffers from a...

CVE-2022-30991

HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30991

HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30991 HTML injection via report name

HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30991

CVE-2022-30991 affects Acronis Cyber Protect 15 (Linux and Windows) before build 29240. The issue is HTML injection via the report name. Connected sources confirm the affected product/version and the vulnerability class; remediation guidance is to update to a version after build 29240. Exploitati...