140 matches found
CVE-2023-49976
CVE-2023-49976 Customer Support System 1.0 - XSS Cross-Site Scripting 취약점 - "subject" 필드"ticketlist" 페이지 설명 : Customer Support System 1.0은 저장형 XSS에 취약합니다. Customer Support System 버전 1에 XSS 취약점이 존재합니다. 악의적인 사용자가 티켓을 편집/생성할 때 "subject" 필드를 통해 JavaScript 코드를 삽입할 수 있습니다. 이 코드는...
CVE-2026-54721
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
CVE-2026-54721
Silverstripe UserForms (a visual form builder module for Silverstripe CMS) contains a remote code execution vulnerability in the email recipient subject field. Between versions 6.0.0 and the fixed releases, a specially crafted payload in the subject field is interpreted as executable server-side ...
PT-2026-82687
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
Gitea: Notification API leaks private issue metadata after access revocation
Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...
GHSA-44QC-PGVP-WX7V Gitea: Notification API leaks private issue metadata after access revocation
Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...
Exploit for CVE-2026-48849
CVE-2026-48849 - Stored XSS, HTML Injection & CSS Injection in...
CVE-2026-23756
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in ControllerStep.InsertSubmit and EditSubmit before being rendered by ViewStep.RenderViewSteps. An authenticated staff member can inject...
CVE-2026-7013 MaxSite CMS mail_send Plugin cross site scripting
A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mailsend Plugin. The manipulation of the argument fsubject/ffiles/ffrom leads to cross site scripting. The attack can be initiated remotely. The exploit has...
CVE-2026-23756
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in ControllerStep.InsertSubmit and EditSubmit before being rendered by ViewStep.RenderViewSteps. An authenticated staff member can inject...
PT-2026-33815
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in...
CVE-2026-34975
The CVE describes a CRLF header injection vulnerability in Plunk’s SESService.ts prior to version 0.8.0. An authenticated API user could inject arbitrary email headers (e.g., Bcc, Reply-To) by embedding CRLF characters in from.name, subject, custom header keys/values, or attachment filenames, bec...
GHSA-FR88-W35C-R596 Parse Server OAuth2 authentication adapter account takeover via identity spoofing
Impact The OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's token introspection endpoint, but does not verify that the token belongs to the user identified by authData.id. An attacker with any valid OAuth2 token...
CVE-2025-60304
code-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting XSS via the Subject Description field...
EUVD-2002-1937
Malware in sbrugna...