EUVD-2026-13380

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 8.9.3, the RecordHandler::getRecord method retrieves any record by module and ID without checking the current user's ACL view permission. The companion saveRecord method...

OpenAtlas 跨站脚本漏洞

OpenAtlas is an Android non-proxy dynamic deployment framework from the Austrian company OpenAtlas. A cross-site scripting vulnerability exists in OpenAtlas version v8.9.0, which stems from insufficient validation of user input in a POST request and could lead to a cross-site scripting attack...

PT-2025-35210

Name of the Vulnerable Software and Affected Versions: OpenAtlas version 8.9.0 Description: OpenAtlas is susceptible to a cross-site scripting XSS issue caused by insufficient validation of user input received through POST requests. This could allow a remote user to send crafted queries to an...

Malicious code in 8.9.4 (npm)

The package 8.9.4 was found to contain malicious code...

CVE-2025-3468 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cleanhtml and formfields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it...

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

Impact The Markdown syntax is vulnerable to XSS through HTML. In particular, using Markdown syntax, it's possible for any user to embed Javascript code that will then be executed on the browser of any other user visiting either the document or the comment that contains it. In the instance that th...

Crypto++ Security Vulnerability

Crypto++ is a C++ cryptographic method library. A security vulnerability exists in Cryptopp Crypto++ version 8.9, which stems from the presence of a fault injection vulnerability that allows an attacker to coexist on the same system as the victim process to disclose information and elevate...