CVE-2026-40878

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw "$SERVER'REQUESTURI'" to Twig as a global template variable and renders it inside a JavaScript string literal in the "setLang" helper of "base.twig"...

iBall 300M Cross-Site Scripting Vulnerability

The iBall 300M is a wireless router product from iBall India. A cross-site scripting vulnerability exists in /goform/setLang in iBall 300M using iB-WRB302N1.0.1-Sep 8 2017 version firmware. A remote attacker can exploit the vulnerability to inject arbitrary web script or HTML with the help of the...

CVE-2018-6355: Improper Neutralization of Input During Web Page Generation

/goform/setLang on iBall 300M devices with "iB-WRB302N1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the lang parameter...

PT-2018-17498

Name of the Vulnerable Software and Affected Versions iBall 300M version iB-WRB302N 1.0.1-Sep 8 2017 Description The issue concerns an Unauthenticated Stored Cross Site Scripting vulnerability. It is exploited via the lang parameter in the "/goform/setLang" API endpoint. Recommendations For versi...

CVE-2005-4527: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via 1 the setLang parameter in index.php and 2 unspecified search module parameters...