CVE-2026-76060

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

PhoenixStorybook: Unbounded atom creation from LiveView event params (atom-table DoS)

Summary An attacker who can deliver psb-assign, psb-toggle, psb-set-theme, upper-tab-navigation, lower-tab-navigation, playground-change, or playground-toggle LiveView events to a mounted Phoenix Storybook playground can flood the BEAM atom table with attacker-controlled strings, permanently...

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

XWiki Contrib Mocca Calendar Application 跨站脚本漏洞

XWiki Contrib Mocca Calendar Application is an open source XWiki plugin for XWiki Contrib. A cross-site scripting vulnerability exists in XWiki Contrib Mocca Calendar Application versions prior to 2.15, which stems from cross-site scripting in the title of the View Events page...

CVE-2023-40224

MISP 2.4.174 allows XSS in app/View/Events/index.ctp...

CVE-2023-40224: Improper Neutralization of Input During Web Page Generation

MISP 2.4.174 allows XSS in app/View/Events/index.ctp...

CVE-2020-13153: Improper Neutralization of Input During Web Page Generation

app/View/Events/resolvedattributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view...

PT-2020-13358

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.126 Description The issue is related to a Cross-Site Scripting XSS flaw in the resolved attributes view. This occurs in the app/View/Events/resolved attributes.ctp file. Recommendations For versions prior to 2.4.126,...

CVE-2020-7215

An issue was discovered in Gallagher Command Centre 7.x before 7.90.991MR5, 8.00 before 8.00.1161MR5, and 8.10 before 8.10.1134MR4. External system configuration data used for third party integrations such as DVR systems were logged in the Command Centre event trail. Any authenticated operator wi...

CVE-2018-8948

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

PT-2018-18734

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.89 Description The issue is related to multiple XSS problems in the app/View/Events/resolved attributes.ctp file of MISP, which can be triggered by a malicious MISP module. Recommendations For versions prior to 2.4.8...

CVE-2018-8948: Improper Neutralization of Input During Web Page Generation

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

NetIQ Sentinel Information Disclosure Vulnerability (CNVD-2018-06631)

NetIQ Sentinel is a security information and event management SIEM solution from US-based NetIQ. The solution collects, stores and analyzes log data and reports on it, as well as analyzing security event data in real time. A security vulnerability exists in NetIQ Sentinel versions prior to 8.1.x...

CVE-2018-6585

SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filtercreator or filtereventscat parameter...

CVE-2018-6585

SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filtercreator or filtereventscat parameter...

CVE-2018-6585: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filtercreator or filtereventscat parameter...

PT-2018-17649

Name of the Vulnerable Software and Affected Versions JTicketing version 2.0.16 Description A SQL Injection issue exists in the JTicketing component for Joomla. This issue can be exploited via a "view=events" action, specifically through the filter creator or filter events cat parameters...

Buddy Zone <= 1.5 - Multiple SQL Injection Vulnerabilities

No description provided by source. --==+================================================================================+==-- --==+ Buddy Zone Version 1.5 And Prior SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR:...

joomla component memorybook 1.2 - Multiple Vulnerabilities

No description provided by source. SQL Injection ------------- requires: magic quotes OFF, user account Add this as the description of a new event: ', 63,SELECT CONCATusername,0x20,email FROM users WHERE gid=25 LIMIT 1,1,1,1 -- ' NOTE: 63 MUST be your Joomla user ID. extracted info can be found o...

Joomla MemoryBook 1.2 SQL Injection / RFI

SQL Injection ------------- requires: magic quotes OFF, user account Add this as the description of a new event: ', 63,SELECT CONCATusername,0x20,email FROM users WHERE gid=25 LIMIT 1,1,1,1 -- ' NOTE: 63 MUST be your Joomla user ID. extracted info can be found on View Events page Remote File...