396956 matches found
CVE-2026-90578
A use-after-free vulnerability exists in the gf_list_count function (utils/list.c) of the MP4Box component in GPAC (affected up to commit f1219cde). The flaw can be triggered via local manipulation with low privileges required and no user interaction, leading to partial compromise of confidential...
CVE-2026-90577
CVE-2026-90577 is a heap-based buffer overflow in the MP4Box component of GPAC (up to commit f1219cde), specifically in the function gf_node_get_field within scenegraph/base_scenegraph.c. The vulnerability requires local access with low privileges and no user interaction, resulting in low impact ...
CVE-2026-90576
GPAC (up to commit f1219cde) contains a null pointer dereference in the function gf_node_list_add_child within scenegraph/base_scenegraph.c of the MP4Box component. A local attacker with low privileges can trigger a denial-of-service condition with no impact on confidentiality or integrity (CVSS ...
CVE-2026-90575
PHPGurukul Small CRM 4.0 contains a deserialization vulnerability in the Login Success Handler component (file /crm/login.php). Manipulation of the geopluginURL argument allows an unauthenticated remote attacker to trigger the unsafe unserialize function, resulting in low integrity impact . The a...
CVE-2026-90574
CVE-2026-90574 affects itsourcecode Sales and Inventory System 1.0 , specifically the file /pages/emp_transac.php?action=add. The SQL injection is triggered by manipulating the firstname argument, allowing a remote attacker with low privileges to compromise data. CVSS 3.1 scores it 6.3 (MEDIUM) w...
CVE-2026-90573
GPAC MP4Box is vulnerable to a null pointer dereference in the function gf_sg_mfurl_del within the file scenegraph/vrml_tools.c . The vulnerability affects GPAC builds up to commit f1219cde and requires local access with low privileges to trigger. The impact is limited to a partial loss of availa...
CVE-2026-90572
A memory corruption vulnerability was identified in davenardella/snap7 (versions up to 1.4.3 ), affecting the function TSnap7MicroClient::opUpload in src/core/s7_micro_client.cpp. Manipulating the DataLen argument can trigger the corruption. The attack is remote over the network but requires high...
CVE-2026-90571
Exrick xmall , an open-source e-commerce platform, is affected by a Cross-Site Scripting (XSS) vulnerability in the Order Printing component. The flaw resides in the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp, where manipulation of an unknown function allows remote exploit...
CVE-2026-90570
linlinjava litemall versions 1.4.0 through 1.8.0 contain a cross-site scripting (XSS) vulnerability in the AdminGoodsService.validate function within the Product Detail component (file: litemall-vue/src/views/items/detail/index.vue). The flaw is triggered by manipulation of the detail argument, a...
CVE-2026-90569
CVE-2026-90569 is a cross-site scripting (XSS) flaw in linlinjava litemall versions 1.5.0 through 1.8.0 , located in the AdminTopicController.validate function within the file litemall-vue/src/views/items/topic/index.vue of the Admin Topic Handler component. The vulnerability can be exploited rem...
CVE-2026-90568
A cross-site scripting (XSS) vulnerability exists in moxi624 Mogu Blog v2 (versions up to 5.2). The flaw is in the function BlogSortServiceImpl.addBlogSort within the file mogu_web/src/main/resources/templates/info.ftl , specifically in the blogSort endpoint. Manipulating the sortName argument al...
CVE-2026-90567
quequnlong shiyi-blog (a blog platform) is affected by a cross-site scripting (XSS) vulnerability in versions up to 1.2.1 . The flaw resides in the highlightKeyword function within the Search component (blog-web/src/components/Search/index.vue), where improper handling of the title/summary argume...
CVE-2026-90566
CVE-2026-90566 affects the Rizwan17 inventory-management-system , an open-source project on GitHub. The vulnerable component is the createUserAccount function in register.php (Registration Handler). Manipulation of the usertype argument leads to improper authorization , allowing a remote, unauthe...
CVE-2026-90565
CVE-2026-90565 affects Rizwan17's inventory-management-system (a GitHub project using rolling release/continuous delivery, so no specific version boundaries are defined). The flaw resides in dashboard.php , where manipulation of the userid argument leads to improper access controls . The vulnerab...
CVE-2026-90564
CVE-2026-90564 is a cross-site scripting (XSS) vulnerability affecting quequnlong shiyi-blog versions 1.0.0 through 1.2.1 . The flaw resides in the function SysChatMsgMapper.getChatMsgList within the file blog-web/src/views/chat/index.vue , specifically in the chat sendMsg Endpoint . Manipulating...
CVE-2026-90563
CVE-2026-90563 is a Cross Site Scripting (XSS) vulnerability in maliangnansheng bbs-springboot version 3.0.0 , specifically in the utils.toToc function within ArticleController.java . The flaw can be exploited remotely by a low-privileged user with user interaction required, resulting in low inte...
CVE-2026-90529
DataEase versions up to 2.10.25/2.10.26 are affected by a Cross-Site Scripting (XSS) vulnerability in the Symbolic Map component. The flaw resides in the buildTooltip function within symbolic-map.ts (frontend chart panel), where manipulation of the argument canvasViewInfo[*].customAttr.tooltip.ba...
CVE-2026-90528
A cross-site scripting (XSS) vulnerability exists in TDuckApp tduck-platform up to version 5.3 , specifically in the Form Write View component (file tduck-front/src/views/form/write/index.vue). The flaw is triggered by manipulating the submitShowCustomPageContent argument, enabling a remote attac...