The vulnerability of the Zimbra Collaboration Suite’s email management system, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the user interface of the Telpo MDM device management platform, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the user interface of the Telpo MDM device management platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

PT-2026-5388

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull request target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access t...

Eclipse Theia – Website security vulnerabilities

Eclipse Theia - Website is an development environment framework created by the Eclipse Foundation. There is a security vulnerability in Eclipse Theia - Website, which stems from the use of pullrequesttarget triggers in GitHub Actions workflows to execute untrusted code. This vulnerability may lea...

CVE-2026-1699: Inclusion of Functionality from Untrusted Control Sphere

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to...

The vulnerability of Tenda W30E wireless Wi-Fi routers’ microprogramming software, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the microprogrammed wireless Wi-Fi router Tenda W30E is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

MalURLBench: A Benchmark Evaluating Agents' Vulnerabilities When Processing Web URLs

LLM-based web agents have become increasingly popular for their utility in daily life and work. However, they exhibit critical vulnerabilities when processing malicious URLs: accepting a disguised malicious URL enables subsequent access to unsafe webpages, which can cause severe damage to service...

The vulnerability of the graphical user interface of the FortiSandbox threat detection and mitigation system allows a perpetrator to perform cross-site scripting attacks.

The vulnerability of the graphical user interface of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

The vulnerability of the Microsoft Outlook email client, related to the lack of protective measures for the website structure, allows attackers to execute arbitrary code.

The vulnerability of the Microsoft Outlook email client is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Jenkins automation server’s plugin-related coverage lies in the lack of protective measures for website structure, allowing attackers to perform cross-site scripting attacks.

The vulnerability of the Jenkins automation server’s plugin-related to the lack of security measures for website structures. Exploiting this vulnerability allows attackers to perform cross-site scripting attacks remotely...

The vulnerability of the Microsoft Outlook email client, related to the lack of protective measures for the website structure, allows attackers to inject arbitrary CSS styles.

The vulnerability of the Microsoft Outlook email client is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary CSS styles remotely...

CVE-2021-47893

creationtimestamp| type| source ---|---|--- 2026-01-23 20:24:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md4jsoh3pq2n...

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform lies in the insufficient protection of the website structure, which allows attackers to execute arbitrary code.

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2021-47860

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

The vulnerability of the IntraService customer interaction system, related to the lack of measures taken to protect the website structure, allows attackers to inject arbitrary HTML content to replace the interface visually and collect metadata.

The vulnerability of the IntraService customer interaction system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML content into the interface, thereby replacing the visual appearance of the...

CVE-2021-47860

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

CVE-2021-47860

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

Exploit for CVE-2025-69457

CVE-2025-69457 – Responsive Tourism Website 3.1 Remote...

MiracleLinux 9 : webkit2gtk3-2.46.1-2.el9_4 (AXSA:2024-8945:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8945:04 advisory. webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution CVE-2024-40776 webkitgtk: webkit2gtk: Processing maliciously crafted web...

The vulnerability of the SAP Business Connector (SAP BC) application, which is related to the lack of protective measures for the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the SAP Business Connector SAP BC application, which is used for automating business processes and data processing, is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...