CVE-2025-49113-Simulation

Roundcube RCE Lab CVE-2025-49113 A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113. 📖 About The Vulnerability This lab demonstrates a sophisticated attack chain against the Roundcub...

CVE-2026-93892

The IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are vulnerable to an information disclosure vulnerability (CWE-200). A remote authenticated attacker can obtain sensitive information because session tokens are exposed within the HTML response in the Admin console. To remediate th...

CVE-2026-93892 Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

CVE-2021-40223

CVE-2021-40223 Application : Rittal CMC PU III Web management Devices : CMC PU III 7030.000 Software Revision : V3.11.002 Hardware Revision : V3.00 Attack type : Stored XSS Solution : Update to Software Revision V3.17.10 or later Summary : Web application fails to sanitize user input on Security...

CVE-2023-43317

CVE-2023-43317 A normal user can elevate their privileges via the userPermissionsLIst parameter in Session Storage component. to gain unauthorized access to administrative-level resources and features. This could lead to unauthorized data access, data modification, and other actions that are...

CVE-2026-109662

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in a public portal form that accepts unauthenticated submissions and subsequently stores content that is rendered with insufficient neutralization ....

CVE-2026-109662 Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that...

CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2026-84312

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated...

CVE-2026-36392

CVE-2026-36392: Stored XSS in RISE CRM Item Title Field Summary A stored cross-site scripting XSS vulnerability exists in the item title field of RISE CRM RISE - Ultimate Project Manager & CRM versions = 3.9.6. An authenticated administrator can inject arbitrary JavaScript into an item's title,...

CVE-2024-48246

CVE-2024-48246 Vehicle Management System 1.0 - Stored Cross-Site Scripting XSS Description Vehicle Management System 1.0 contains a Stored Cross-Site Scripting XSS vulnerability in the Name parameter of /vehicle-management/booking.php. A malicious actor can inject malicious payloads into the Name...

CVE-2026-104140

QGIS Server is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the WFS3 (OGC API Features) HTML responses. The root cause is the lack of HTML escaping for feature attribute values processed via QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. An attacker can inject...

CVE-2025-56807

CVE-2025-56807 Description A Stored Cross Site Scripting XSS vulnerability was discovered in FairSketch RISE Ultimate Project Manager & CRM v3.9.4 in the File Manager functionality. The vulnerability lies in the title parameter that is submitted when creating new folders. Due to insufficient inpu...

CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-109559

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109426

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

CVE-2026-84360 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

EUVD-2026-97888

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

EUVD-2026-97882

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559

EdgeEver Desktop versions 1.6.26 through 1.112.0 are vulnerable to a navigation allowlist bypass caused by insufficient string-prefix URL matching . Attackers can exploit this by embedding a link using userinfo syntax after the dev-server prefix—for instance, within a note-template preview—to loa...