CVE-2026-71901

A flaw was found in Apache OFBiz. An authenticated user with access to the Sales Force Automation SFA component can override the service parameter invoked during a vCard file import. This flaw allows an attacker to execute unauthorized internal services, potentially exposing or modifying sensitiv...

CVE-2026-71901

Improper Control of Resource Identifiers 'Resource Injection' vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to...

CVE-2026-71901

Apache OFBiz is vulnerable to an Improper Control of Resource Identifiers (Resource Injection) flaw. An authenticated user with access to the Sales Force Automation (SFA) component can override the service parameter during a vCard file import . This allow an attacker to dispatch arbitrary interna...

CVE-2026-71901 Apache OFBiz: Dispatch arbitrary internal services on SFA component

Improper Control of Resource Identifiers 'Resource Injection' vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to...

EUVD-2026-117495

Improper Control of Resource Identifiers 'Resource Injection' vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to...

craftcms-vcard-exploit

Craft CMS vCard Plugin Deserialization Vulnerability Craft CMS has a plugin for downloading contacts in a .vcf file format titled "vCard". The plugin can be reviewed in Craft's repository and Github: Craft Plugin Store Github Description This plugin takes a parameter sent by the client, decrypts...

CVE-2026-118603

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

CVE-2026-118603

The Alpine iLX-F511 is vulnerable to a stack-based buffer overflow during the parsing of vCard data . The root cause is the lack of proper validation of user-supplied data before copying it to a fixed-length stack-based buffer. This flaw allows a network-adjacent attacker to execute arbitrary cod...

EUVD-2026-112196

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

CVE-2026-118603 Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

Alpine iLX-F511 buffer error vulnerability

The Alpine iLX-F511 running version 7.0.0000 contains a buffer error vulnerability. This vulnerability arises because when parsing vCard data, user-provided data is copied into a stack buffer of fixed length without proper validation, resulting in a stack buffer overflow. Network-adjacent attacke...

CVE-2026-118603: Stack-based Buffer Overflow

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

PT-2026-128318

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

(0Day) (Pwn2Own) Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data...

Updated evolution package fixes a security vulnerability

Javascript execution via spoofed vcard control bypasses mail script-markup restriction. CVE-2026-88859...

MGASA-2026-0554 Updated evolution package fixes a security vulnerability

Javascript execution via spoofed vcard control bypasses mail script-markup restriction. CVE-2026-88859...

SUSE CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

DEBIAN-CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859 Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...