21 matches found
CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...
CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...
CVE-2026-47185
CVE-2026-47185 — Frappe Workspace Save API : In Frappe, prior to version 16.18.0, the Workspace Save API accepted a controlled workspace identifier from any authenticated user without enforcing workspace ownership, enabling modification of another user’s private workspace and risking persistent s...
CVE-2026-47185: Incorrect Authorization
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
SummaryPillow's TGA RLE encoder reads past its row buffer when saving a mode "1"image. Adjacent process heap bytes can be copied into the generated TGA file.The bug is reachable through the public save API:pythonim.saveout, format="TGA", compression="tgarle"Older affected Pillow versions use the...
PT-2026-64103
Summary Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1" image. Adjacent process heap bytes can be copied into the generated TGA file. The bug is reachable through the public save API: python im.saveout, format="TGA", compression="tga rle" Older affected Pillow versions u...
GHSA-FJ7V-R99M-22GQ Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Summary Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1" image. Adjacent process heap bytes can be copied into the generated TGA file. The bug is reachable through the public save API: python im.saveout, format="TGA", compression="tgarle" Older affected Pillow versions us...
CVE-2026-36460: Improper Neutralization of Input During Web Page Generation
Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding...
Dovestones ADPhonebook 跨站脚本漏洞
Dovestones ADPhonebook is a corporate address book and employee directory management system developed by the Canadian company Dovestones. Versions of Dovestones ADPhonebook prior to 4.0.1.1 contained security vulnerabilities. These vulnerabilities stemmed from insufficient input validation and...
CVE-2026-36460
Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding...
CVE-2026-36460
Dovestones Softwares ADPhonebook versions prior to v4.0.1.1 are vulnerable to a Cross Site Scripting (XSS) vulnerability. The root cause is the lack of proper input validation and output encoding within the /Admin/Save API . This flaw allows an authenticated administrator to inject and store mali...
WordPress Paytium: Mollie payment forms & donations plugin <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys' vulnerability
Missing Authorization in 'paytiumswsaveapikeys' vulnerability discovered by WordFence in WordPress Plugin Paytium versions = 4.3.7...
CVE-2021-33031
In LabCup before...
PT-2024-16167 · WordPress · Ce21 Suite
Name of the Vulnerable Software and Affected Versions: CE21 Suite plugin for WordPress versions up to, and including, 2.2.0 Description: The issue is related to unauthorized modification of data due to a missing capability check on the ce21 single sign on save api settings function. This allows...
VulnCheck KEV: CVE-2023-7289
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytiumswsaveapikeys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level...
PT-2024-25754 · Unknown · Computer Laboratory Management System
Name of the Vulnerable Software and Affected Versions: Computer Laboratory Management System version 1.0 Description: The issue concerns a Cross Site Scripting vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the firstname, middlename, lastname parameters in th...
CVE-2021-33031
In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...
CVE-2021-33031
In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...
Authentication flaw
In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...
