65001 matches found
BIT-GHOST-2026-105644 Ghost: Stored XSS via SVG Files in Content Imports
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff...
BIT-GHOST-2026-105643 Ghost: Stored XSS via Embed Card Previews
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...
CVE-2026-108969
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument...
CVE-2026-108969 itsmeravitejak Online-Examination-System Session session.php checkLogin comparison
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument...
EUVD-2026-98292
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument...
CVE-2026-108969 itsmeravitejak Online-Examination-System Session session.php checkLogin comparison
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument...
CVE-2026-108969
A security vulnerability exists in the Session Handler component of the itsmeravitejak Online-Examination-System (up to commit e6208e630b14657999bbfe4c9912302d2a1e2449). The flaw is located in the Session::checkLogin function within the include/session.php file, where manipulation of the cookname...
CVE-2026-89117
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...
CVE-2026-89120
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...
CVE-2026-76972
Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...
EUVD-2026-98084
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...
EUVD-2026-98199
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...
CVE-2026-89120
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from the FLP . A low-privileged attacker could exploit this by sending specially crafted requests to bypass res...
CVE-2026-89120 Missing authorization check in SAP ABAP Platform
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...
CVE-2026-89117
SAP NetWeaver Enterprise Portal is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). An unauthenticated attacker can inject malicious scripts into a URL parameter , which are reflected in the server response and executed in a victim's browser upon visiting a crafted URL. This can lead to ...
CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...
EUVD-2026-98197
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...
CVE-2026-76972
A Cross-Site Scripting (XSS) vulnerability exists in SAP Manufacturing Integration and Intelligence (CWE-79). The root cause is the improper neutralization of input during web page generation, allowing an attacker to store malicious content that is subsequently rendered by the application. If an ...
CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence
Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...
EUVD-2026-98185
Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...