661 matches found
CVE-2026-75114
The Joomla Zoo extension (versions before 4.1.64) passes the unsanitized referer request parameter directly to setRedirect() in CommentController::twitterAuthenticate(), enabling phishing via crafted redirect URLs. CVSS 5.1 (MEDIUM) with network access and user interaction required. No in-the-wil...
EUVD-2026-62433
Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate in Zoo 4.1.64 - The referer request parameter is passed straight to setRedirect with no validation...
CVE-2026-75114 Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64
Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate in Zoo 4.1.64 - The referer request parameter is passed straight to setRedirect with no validation...
CVE-2026-74804 Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...
CVE-2026-74804 Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...
EUVD-2026-62430
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...
CVE-2026-74804
Zoo (yootheme.com Joomla extension, versions
PT-2026-78367
Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated SQL injection exists in the element function of the ItemController. The issue occurs because the filter type request value and the type filter array are interpolated into the database...
PT-2026-78366
Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated arbitrary file upload issue exists in the image element. The system accepts arbitrary files as long as the client-supplied Content-Type falls within the image MIME group Multipurpose...
PT-2026-78368
Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An open redirect exists in the CommentController::twitterAuthenticate function. The issue occurs because the referer request parameter is passed directly to the setRedirect function without proper...
CVE-2026-30526
A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in the login page, specifically within the msg parameter. The application reflects the content of the msg parameter back to the user without proper HTML encoding or...
EUVD-2026-17899
A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in the login page, specifically within the msg parameter. The application reflects the content of the msg parameter back to the user without proper HTML encoding or...
CVE-2026-30526
A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in the login page, specifically within the msg parameter. The application reflects the content of the msg parameter back to the user without proper HTML encoding or...
CVE-2026-30526
CVE-2026-30526 affects SourceCodester Zoo Management System v1.0. The vulnerability is located on the login page in the msg parameter, where user-supplied content is echoed back without proper HTML encoding/sanitization, enabling a reflected XSS via a crafted URL. The connected documents confirm ...
SourceCodester Zoo Management System 安全漏洞
The SourceCodester Zoo Management System is an open-source zoo management system developed by SourceCodester. Version 1.0 of the SourceCodester Zoo Management System contains a security vulnerability. This vulnerability stems from a reflection cross-site scripting vulnerability in the msg paramet...
CVE-2026-30526
A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in the login page, specifically within the msg parameter. The application reflects the content of the msg parameter back to the user without proper HTML encoding or...
CVE-2026-30526
A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in the login page, specifically within the msg parameter. The application reflects the content of the msg parameter back to the user without proper HTML encoding or...
CVE-2022-31897
SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting XSS via publichtml/registervisitor?msg=...
Malicious code in eslint-config-zoo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20693f27e329a7fcc147d2a795f91732a8aca8b142bd27f0ec38803814ae388a The package eslint-config-zoo was found to contain malicious code. Source: ghsa-malware...