1684 matches found
osTicket - Arbitrary File Read
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...
CVE-2019-12836
CVE-2019-12836 Application JEditor v3.0.5 - WYSIWIG Editor for JIRA Simple yet powerful rich text editor for Jira. Import HTML emails, paste rich contents, create templates and prepopulate fields. Vendor of Product Bobronix Vendor Website http://bobronix.com/ CVE Reference...
kitty
Introduction | Sulley: Boo? | Boo: Kitty! What is Kitty? Kitty is an open-source modular and extensible fuzzing framework written in python, inspired by OpenRCE's Sulley and Michael Eddington's and now Deja Vu Security's Peach Fuzzer . Goal When we started writing Kitty, our goal was to help us...
CVE-2026-73320
CVE-2026-73320: Unauthenticated unfurl result disclosure XenForo before 2.3.13 exposes pending rich-link previews through an unauthenticated endpoint keyed by predictable integer IDs. What happens unfurl.php accepts a POST containing global UnfurlResult IDs, loads those rows, and returns rendered...
CVE-2026-22849
CVE-2026-22849: Saleor lacks proper HTML sanitization in rich text fields Overview Field| Details ---|--- CVE ID| CVE-2026-22849 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products saleor/saleor Details Saleor was allowing users to modify rich text fields with HTM...
CVE-2026-34212
CVE-2026-34212 Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin. Intro I identified, responsibly disclosed, and reproduced a High-severity stored XSS issue in Docmost , the...
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
Summary A rejected upload can remain in the operating system temporary directory. Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk...
CVE-2026-113658
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it...
CVE-2026-113658 ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it...
EUVD-2026-105188
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it...
CVE-2026-70093
Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally...
CVE-2026-70096
Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network...
CVE-2026-110239
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...
CVE-2026-70093
A heap-based buffer overflow exists in the Windows Rich Text Edit Control . This vulnerability allows an authorized attacker to achieve local privilege elevation . No specific exploit information or workaround details are provided in the documents.
CVE-2026-70096
A heap-based buffer overflow exists in the Windows Rich Text Edit Control , which could allow an unauthorized attacker to achieve Remote Code Execution (RCE) over a network. This vulnerability is rated with a CRITICAL CVSS score of 9.8 . Microsoft has released official updates to address this iss...
CVE-2026-110239 Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...
CVE-2026-110239 Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...
CVE-2026-110239
The Rapyd Admin software versions prior to 9.20.0 is vulnerable to a stored cross-site scripting (XSS) flaw within the x-rpd::rich-text Blade component. The root cause is the component's failure to sanitize bound model values, which are instead output as raw HTML. An authenticated user can exploi...
