26 matches found
CVE-2026-33240
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...
EUVD-2026-64175
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...
CVE-2026-33240
Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API prior to version 3.2.3 . The flaw allows an attacker to inject malicious scripts that execute in a victim's browser when they interact ...
PT-2026-79489
Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web-based IT service management tool. A reflected cross-site scripting XSS flaw exists in the foreign key search criteria API, where user-supplied input is not properly sanitiz...
CVE-2026-59853
SiYuan prior to 3.7.1 exposes saved search criteria via /api/storage/getCriteria without publish-access filtering, enabling a publish-mode Reader to read private document paths, notebooks, documents, and block IDs, and to search/replace keywords for unpublished documents. This reflects a data-exp...
CVE-2026-59853 SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private...
PT-2026-57010
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.1 Description The '/api/storage/getCriteria' endpoint returns saved search criteria from the data/storage/criteria.json file without applying the publish-access filtering used by other storage endpoints. This allow...
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
Several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. Details Raw...
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
Several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. Details Raw...
PT-2026-48340
Name of the Vulnerable Software and Affected Versions Net::IMAP versions prior to 0.6.5 Net::IMAP versions prior to 0.5.15 Description Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Certain commands accept a raw data argument that is sent verbatim after...
GHSA-HM49-WCQC-G2XG net-imap vulnerable to command Injection via "raw" arguments to multiple commands
Summary Several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. Details Net::IMAP's...
CVE-2023-40809
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number...
EUVD-2023-2999
Malicious code in bioql PyPI...
CVE-2023-27151
openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...
Design/Logic Flaw
openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...
CVE-2023-27151
openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...
CVE-2023-27151
openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...
GHSA-MFP5-VH58-3J3R Cross-site Scripting in OpenCRX
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number...
