441 matches found
EUVD-2026-60571
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...
CVE-2026-15371 Velociraptor Stored XSS in URL column types
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...
CVE-2026-15371 Velociraptor Stored XSS in URL column types
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...
CVE-2026-15371
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...
CVE-2026-15371 Velociraptor Stored XSS in URL column types
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...
CVE-2026-15371
Velociraptor's web GUI URL column type accepts arbitrary schemes (e.g., javascript:), enabling stored XSS when a victim clicks a crafted link. Root cause is lack of scheme allow-listing. CVSS 8.1 (HIGH) requires high privileges and user click. Exploitation in the wild is not reported. Advisory: h...
CVE-2026-15371: Improper Handling of URL Encoding (Hex Encoding)
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...
PT-2026-76907
Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description The web GUI allows the specification of custom column types for tables. When the URL type is used, the system forms a clickable link from the cell value. Because the code does not restri...
Ghostlink_lite
GHOSTLINK // Enterprise Cyber Command Center & Defensive Scann...
CVE-2026-24788
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...
PT-2026-5604
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...
CVE-2020-12814
A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiAnalyzer version 6.0.6 and below, version 6.4.4 allows attacker to execute unauthorized code or commands via specifically crafted requests to the web GUI...
CVE-2024-45161
A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507. This can be exploited via a URL, an image load, an XMLHttpRequest, etc. and can result in exposure of data or unintended code execution...
EUVD-2024-55042
A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507. This can be exploited via a URL, an image load, an XMLHttpRequest, etc. and can result in exposure of data or unintended code execution...
CVE-2024-45161: Cross-Site Request Forgery (CSRF)
A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507. This can be exploited via a URL, an image load, an XMLHttpRequest, etc. and can result in exposure of data or unintended code execution...
EUVD-2004-2270
Malware in sbrugna...
EUVD-2013-0483
Malware in sbrugna...
EUVD-2020-21412
Malware in sbrugna...