529 matches found
CVE-2026-122300
Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role...
CVE-2026-118414
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...
CVE-2026-118408
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog...
CVE-2026-111824
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for...
CVE-2026-105152
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rath...
EUVD-2026-123520
Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects...
CVE-2026-123374 Apache Roller: Deserialization of untrusted data in weblog update ping responses
Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects...
CVE-2026-122300 Apache Roller: Limited weblog members can remove or change published entries
Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role...
CVE-2026-122300
Apache Roller versions 4.0 through 6.1.6 are affected by a Missing Authorization vulnerability (CWE-862). The issue occurs because the entry editor validates a member's weblog role but fails to verify if that specific role grants permission to modify the entry. This allows a weblog member with th...
CVE-2026-122300 Apache Roller: Limited weblog members can remove or change published entries
Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role...
EUVD-2026-123518
Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role...
CVE-2026-118414 Apache Roller: Stored cross-site scripting through the weblog description
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...
EUVD-2026-123516
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...
CVE-2026-118414
Apache Roller versions 6.1.2 through 6.1.6 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from an HTML-stripping routine that fails to close a specific tag, combined with the main menu printing the weblog description without proper escaping. This allows a weblog admin...
CVE-2026-118414
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...
CVE-2026-118414 Apache Roller: Stored cross-site scripting through the weblog description
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...
EUVD-2026-123515
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme...
CVE-2026-118408 Apache Roller: Unpublished entries of other weblogs readable through preview
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog...
EUVD-2026-123506
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog...
CVE-2026-118408
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog...