CVE-2015-1855

reproducer for CVE-2015-1855 how to reproduce it: create the necessary infra-structure $ bash 1.sh set the vulnerable ruby my system ruby is vulnerable $ rvm use system $ ruby -v 1.rb $ ruby 2.1.2p95 2014-05-08 revision 45877 x8664-linux-gnu true true means vulnerable set the fixed ruby $ rvm use...

EUVD-2026-65176

Unauthenticated Cross Site Scripting XSS in Stripe Payments = 2.1.2 versions...

CLSA-2026-1776213251 TuxCare security update for serialize-javascript (3 CVEs)

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1...

CLSA-2026-1774311647 TuxCare security update for formidable (4 CVEs)

TuxCare rebuilt formidable to address 4 CVEs. Fixed in 2.1.2-tuxcare.1...

CLSA-2025-1750810248 TuxCare security update for waitress (1 CVE)

TuxCare rebuilt waitress to address 1 CVE. Fixed in 2.1.2.post2+tuxcare...

CVE-2026-6089 WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

CVE-2026-65477 WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

EUVD-2026-48088

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

CVE-2026-65477

CVE-2026-65477 affects the WordPress Tonda Core plugin, version ≤ 2.1.2, with a Local File Inclusion vulnerability. Root cause: LFI in Tonda Core ≤ 2.1.2. Impact includes high confidentiality, integrity, and availability risk (CVSS 3.1: 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation stat...

CVE-2026-52475

Cross Site Scripting vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file...

CVE-2026-52475

Cross Site Scripting vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file...

CVE-2026-16194

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/webfetch/webfetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has...

CVE-2026-15330

CVE-2026-15330 affects zhayujie CowAgent — Vision Tool, specifically the file vision.py, function _build_image_content/_download_to_data_url. The vulnerability arises from manipulating the input image argument, enabling remote SSRF via the Vision Tool component. Attacker could trigger remotely; e...

PT-2026-57078

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function build image content/ download to data url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The...

Apache Superset uncontrolled resource consumption

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1...

Apache Superset Cross-site Scripting vulnerability

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint.This issue affects Apache Supers...

PT-2026-53823

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII name, email, phone, address, payment information from...

CVE-2026-57322

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2...

CVE-2026-57322 WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2...

PT-2026-52696

Name of the Vulnerable Software and Affected Versions Apache Kerby versions prior to 2.1.2 Description Sending a deeply nested ASN1 Abstract Syntax Notation One, a standard interface for describing data structures structure to a client or service can trigger a StackOverFlow Exception, resulting i...