CVE-2026-104807

The Mitel MiVoice Office 400 web portal is vulnerable to a stored Cross-Site Scripting (XSS) flaw (CWE-79). The issue resides in the Configuration → Domains section, specifically within the "Description" field, where the application fails to properly validate or sanitize user-supplied input befor...

CVE-2026-104807 Mitel MiVoice Office 400 stored Cross-Site Scripting

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domain...

EUVD-2026-92296

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domain...

CVE-2026-104807 Mitel MiVoice Office 400 stored Cross-Site Scripting

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domain...

CVE-2026-104806

The Mitel MiVoice Office 400 System is vulnerable to a path traversal flaw in the web management portal (TCP port 443) within the Maintenance → System Logs functionality. Due to insufficient validation of user-supplied file paths, an attacker with high privileges can traverse the directory struct...

CVE-2026-104806 Mitel MiVoice Office 400 System Logs Path Traversal Information Disclosure

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

EUVD-2026-92293

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

[SECURITY] Fedora 44 Update: chromium-154.0.8037.92-1.fc44

Chromium is an open-source web browser, powered by WebKit Blink...

robin

Robin: strumento OSINT per il dark web basato sull'IA Robin è uno strumento basato sull'IA per condurre indagini OSINT sul dark web. Sfrutta gli LLM per perfezionare le query, filtrare i risultati di ricerca dai motori di ricerca del dark web e fornire un riepilogo dell'indagine. Installazione •...

CVE-2026-104808: Improper Neutralization of Input During Web Page Generation

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening...

Debian dsa-6544 : sabnzbdplus - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6544 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6544-1 [email protected] https://www.debian.org/security/ Moritz...

Cisco ASA Path Traversal (CVE-2020-3187)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...

An Evaluation of the Semantic Understanding Capabilities of Large Language Models for Web Attack Payloads

Computer vision services delivered through Web interfaces and APIs process textual requests for image-resource acquisition, inference-task configuration, and result management, making Web attack-payload analysis relevant to their deployment security. Large language models LLMs can identify payloa...

PT-2026-104773

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening...

CVE-2026-103084: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109...

CVE-2026-100515: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30...

CVE-2026-104810: Path Traversal: 'dir\..\..\filename'

This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management →...

CVE-2026-104807: Improper Neutralization of Input During Web Page Generation

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domain...