CVE-2025-1974

CVE-2025-1974 White Hat School 3rd Cohort - Kim So-eun @salt318 https://github.com/salt318/vulhub Summary Caused by a defect in the Ingress-NGINX Admission Controller, a core security mechanism of Kubernetes The Ingress-NGINX Admission Controller is exposed to the network without authentication...

EUVD-2026-122958

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1...

CVE-2026-125878

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1...

CVE-2026-125878 Multiple OGNL Injection vulnerabilities

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1...

CVE-2026-125878

The N-able N-central platform is vulnerable to multiple OGNL Injection vulnerabilities in versions prior to 26.4.1 . The root cause is the improper neutralization of input during web page generation, which can lead to Resource Injection . While the description mentions cross-site scripting, the t...

CVE-2026-109810

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

PT-2026-144751

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1...

PT-2026-141257

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Web Dynpro Java affected versions not specified Description SAP NetWeaver Application Server Java Web Dynpro Java fails to sufficiently validate certain request parameters used to resolve styling resources...

CVE-2026-125878: N-able N-central: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central…

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1...

CVE-2026-71901

Improper Control of Resource Identifiers 'Resource Injection' vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to...

CVE-2026-71901 Apache OFBiz: Dispatch arbitrary internal services on SFA component

Improper Control of Resource Identifiers 'Resource Injection' vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to...

CVE-2026-71901

Apache OFBiz is vulnerable to an Improper Control of Resource Identifiers (Resource Injection) flaw. An authenticated user with access to the Sales Force Automation (SFA) component can override the service parameter during a vCard file import . This allow an attacker to dispatch arbitrary interna...

EUVD-2026-117495

Improper Control of Resource Identifiers 'Resource Injection' vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to...

CVE-2026-118548

Incorrect Authorization vulnerability in Drupal AI Artificial Intelligence allows Resource Injection. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...

EUVD-2026-113504

Incorrect Authorization vulnerability in Drupal AI Artificial Intelligence allows Resource Injection. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...

CVE-2026-118548

The Drupal AI (Artificial Intelligence) module (versions 0.0.0 to 1.4.11 and 1.5.0 to 1.5.2 ) is affected by an Incorrect Authorization vulnerability (CWE-863) that allows Resource Injection . The root cause is that the module does not sufficiently validate links under specific conditions, which ...

CVE-2026-118548 AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

Incorrect Authorization vulnerability in Drupal AI Artificial Intelligence allows Resource Injection. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...

CVE-2026-118548 AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

Incorrect Authorization vulnerability in Drupal AI Artificial Intelligence allows Resource Injection. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...

CVE-2026-118548: Drupal AI (Artificial Intelligence): Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection

Incorrect Authorization vulnerability in Drupal AI Artificial Intelligence allows Resource Injection. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...

ROS-20261022-73-0032

The vulnerability in the mongo-c-driver is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability can allow an attacker to cause a service failure...