291334 matches found
CVE-2026-103543: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclos...
CVE-2026-103587
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...
CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...
CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...
CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...
CVE-2026-103587
QloApps versions through 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) flaw within the back-office Hotel Reservation System Book Now search functionality. The vulnerability occurs because the date_to and id_room_type parameters are copied into template variables without sufficien...
rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary...
CVE-2026-51853
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...
CVE-2026-102142
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...
CVE-2026-102120
A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...
CVE-2026-102117
On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could...
CVE-2026-102117 Kiteworks Core Remote Code Execution
On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could...
EUVD-2026-90302
On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could...
CVE-2026-102117
The Kiteworks Core platform is vulnerable to Remote Code Execution (RCE) when the remote-support capability is licensed and enabled. An authenticated System Administrator who possesses the key protecting the submitted data can redirect the system's outbound support connection to a destination of ...
CVE-2026-102126 Kiteworks Core Stored Cross-site Scripting (XSS)
A stored cross-site scripting XSS weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected pag...
CVE-2026-102129 Kiteworks Core Incorrect Privilege Assignment
A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...
CVE-2026-102129 Kiteworks Core Incorrect Privilege Assignment
A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...
CVE-2026-102129
A privilege escalation vulnerability exists in the user-provisioning interface of Kiteworks Core . The root cause is a failure to verify if the requesting administrator possesses the authorization required to grant specific roles. Consequently, an administrator with limited permissions for role c...
EUVD-2026-90284
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned...
CVE-2026-102142 Kiteworks Core Remote Code Execution through Server-Side Template Injection
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...