5788 matches found
PT-2026-20849
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful GIF file that results in...
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
Summary Rack::Directory generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the javascript: scheme e.g. javascript:alert1, the generated index includes an anchor whose href attribute is exactly...
PT-2026-7003
Name of the Vulnerable Software and Affected Versions code-projects Online Student Management System version 1.0 Description A flaw exists in the Login component of the Online Student Management System. Specifically, a SQL injection issue is present in the accounts.php file due to manipulation of...
PT-2026-6705
Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0 Description A flaw exists in itsourcecode Student Management System 1.0. The issue involves the manipulation of the ID argument within an unknown function of the...
CVE-2026-23059
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xxcopyfpinpkt and qla27xxcopymultiplepkt, the framesize reported by firmware is used to calculate the copy length into item-iocb. However, the iocb member is...
GHSA-PQXR-3G65-P328 jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
Impact User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the addImage and html methods when processing BMP image data with unvalidated dimensions. An attacker can cause excessive memory allocation and application unavailability by...
XML Injection
Overview Affected versions of this package are vulnerable to XML Injection via the addMetadata function. An attacker can compromise the integrity of generated PDF files by injecting arbitrary XML into the XMP metadata, potentially spoofing document authorship or other metadata fields. Workaround...
CVE-2026-1299
A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules,...
CVE-2026-24489 Gakido vulnerable to HTTP Header Injection (CRLF Injection)
Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF Carriage Return Line Feed sequences in user-supplied header values and names. When making HTTP...
MiracleLinux 8 : python3-3.6.8-47.el8.ML.1 (AXSA:2022-3849:02)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3849:02 advisory. pythonmailcap: findmatch function does not sanitise the second argument CVE-2015-20107 python: urllib.parse does not sanitize URLs containing ASCII...
Schneider Electric Zigbee Products
GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...
Schneider Electric EcoStruxure Power Build Rapsody (Update A)
GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install physical controls so no unauthorized personnel can access...
PT-2026-2264
Name of the Vulnerable Software and Affected Versions Imaster's MEMS Events CRM affected versions not specified Description The software contains an SQL injection issue in the keyword parameter of the '/memsdemo/exchange offers.php' API endpoint. This allows for potential unauthorized database...
CVE-2022-0411
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the postid parameter before using it in a SQL statement via a REST route of the plugin accessible to any authenticated user, leading to a SQL injection...
CVE-2025-68428 jsPDF has Local File Inclusion/Path Traversal vulnerability
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...
CVE-2025-68428 jsPDF has Local File Inclusion/Path Traversal vulnerability
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...
PT-2026-26624
Name of the Vulnerable Software and Affected Versions CPython affected versions not specified Description The webbrowser.open API accepted leading dashes in URLs, which could be interpreted as command line options by certain web browsers. This behavior has been modified to reject leading dashes...
PT-2025-53685
Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0 Description A SQL injection issue exists in itsourcecode Student Management System 1.0. Manipulation of the ID argument in the /statistical.php file can lead to SQL injection. The attack can b...
