CVE-2026-103536

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId lead...

CVE-2026-103536

A vulnerability exists in ZongXR Supermarket 1.0.0.0 within the save Endpoint component. Specifically, the OrderController.addOrder function located in order/src/main/java/com/supermarket/order/controller/OrderController.java fails to perform proper authentication. An attacker can remotely execut...

EUVD-2026-90476

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId lead...

CVE-2018-16373

CVE-2018-16373 There is a Upload vulnerability that can create file via /admin/?/plugin/filemanager/save,more detail see:https://github.com/philippe/FrogCMS/issues/13...

CVE-2026-27541-Analysis-Lab

CVE-2026-27541 — WooCommerce Wholesale Prices Authenticated Privilege Escalation Lab Overview This project is a local Docker lab for analyzing and reproducing the behavior of CVE-2026-27541 in the WooCommerce Wholesale Prices / Wholesale Suite plugin by comparing vulnerable and patched builds...

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...

CVE-2026-94045

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

CVE-2026-94045: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

PT-2026-96002

Name of the Vulnerable Software and Affected Versions newbee-ltd newbee-mall versions prior to 1.0.1 Description A remote cross site scripting issue exists in the Goods Save Endpoint within the controller/common/UploadController.java file. By manipulating the goodsName argument, an attacker can...

CVE-2026-92418

A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes...

EUVD-2026-80938

A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes...

CVE-2026-92418 ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting

A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes...

CVE-2026-92418 ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting

A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes...

CVE-2026-92418

A cross-site scripting (XSS) vulnerability exists in the Save Endpoint component of ChangeWeDer crm (up to commit c07bd4c9), specifically in the file src/main/resources/public/js/customerServe/customer.serve.js. Manipulation of the customerName argument allows an authenticated remote attacker to ...

CVE-2026-92418: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes...

CVE-2026-86644

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file websrc/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The explo...

CVE-2026-86644

star7th showdoc up to 3.9.1 contains a cross-site scripting (XSS) vulnerability in the file web_src/public/editor.md/editormd.js , triggered through the API Page Save Endpoint . The flaw allows a remote, authenticated attacker to execute arbitrary script via manipulation of the editor component. ...

CVE-2026-86644: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file websrc/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The explo...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...