| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-41022 | Med | 0.38 | 5.9 | 0.00 | Oct 27, 2026 | Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4. | ||
| CVE-2026-41021 | Hig | 0.49 | 7.5 | 0.00 | Oct 27, 2026 | Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials. | ||
| CVE-2026-41020 | Hig | 0.49 | 7.5 | 0.00 | Oct 27, 2026 | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device. | ||
| CVE-2026-13162 | Hig | 0.50 | — | 0.00 | Oct 27, 2026 | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is… | ||
| CVE-2026-117499 | Low | 0.17 | 3.7 | 0.00 | Oct 27, 2026 | @fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the… | ||
| CVE-2026-115408 | Med | 0.29 | 5.5 | 0.00 | Oct 27, 2026 | In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never… | ||
| CVE-2026-115216 | Cri | 0.59 | — | 0.00 | Oct 27, 2026 | In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret… | ||
| CVE-2026-113644 | Med | 0.29 | — | 0.00 | Oct 27, 2026 | In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent… | ||
| CVE-2026-112362 | Cri | 0.52 | 9.1 | 0.00 | Oct 27, 2026 | @fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash… | ||
| CVE-2026-10756 | Hig | 0.50 | — | 0.00 | Oct 27, 2026 | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting… | ||
| CVE-2026-10752 | Med | 0.24 | 4.8 | 0.00 | Oct 27, 2026 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for… | ||
| CVE-2026-109995 | Hig | 0.47 | 7.2 | 0.00 | Oct 27, 2026 | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it… | ||
| CVE-2026-106087 | Hig | 0.57 | — | 0.00 | Oct 27, 2026 | TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive… | ||
| CVE-2026-105323 | Med | 0.40 | 6.1 | 0.00 | Oct 27, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS. This issue affects Kulga News Software: from v26.7.4 before v26.10.0. | ||
| CVE-2026-102800 | Hig | 0.57 | — | 0.00 | Oct 27, 2026 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php),… | ||
| CVE-2026-117541 | Med | 0.27 | 5.3 | 0.00 | Oct 27, 2026 | svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing… | ||
| CVE-2026-117540 | Hig | 0.42 | 7.5 | 0.00 | Oct 27, 2026 | svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing… | ||
| CVE-2026-117539 | Low | 0.16 | 3.5 | 0.00 | Oct 27, 2026 | darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes… | ||
| CVE-2026-117538 | Med | 0.20 | 4.1 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link… | ||
| CVE-2026-117537 | Med | 0.20 | 4.1 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that… | ||
| CVE-2026-117536 | Hig | 0.50 | 8.8 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can… | ||
| CVE-2026-117535 | Med | 0.33 | 6.1 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking… | ||
| CVE-2026-117534 | Med | 0.28 | 5.4 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or… | ||
| CVE-2026-117533 | Med | 0.22 | 4.4 | 0.00 | Oct 27, 2026 | REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory… | ||
| CVE-2026-117532 | Cri | 0.57 | 9.8 | 0.01 | Oct 27, 2026 | REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for… | ||
| CVE-2026-117530 | Med | 0.44 | 6.7 | 0.00 | Oct 27, 2026 | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands | ||
| CVE-2026-117466 | Hig | 0.56 | — | 0.00 | Oct 27, 2026 | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. | ||
| CVE-2026-117341 | Hig | 0.50 | — | 0.00 | Oct 27, 2026 | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting… | ||
| CVE-2026-116900 | Med | 0.28 | 5.4 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that… | ||
| CVE-2026-116899 | Med | 0.35 | 6.5 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the… | ||
| CVE-2026-116898 | Hig | 0.39 | 7.1 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories… | ||
| CVE-2026-116897 | Med | 0.35 | 6.5 | 0.00 | Oct 27, 2026 | REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback],… | ||
| CVE-2026-116896 | Hig | 0.42 | 7.5 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain… | ||
| CVE-2026-116895 | Med | 0.28 | 5.4 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode,… | ||
| CVE-2026-116894 | Med | 0.20 | 4.2 | 0.00 | Oct 27, 2026 | REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie… | ||
| CVE-2026-116893 | Med | 0.37 | 6.8 | 0.00 | Oct 27, 2026 | REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall… | ||
| CVE-2026-116892 | Med | 0.33 | 6.1 | 0.00 | Oct 27, 2026 | SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw… | ||
| CVE-2026-116891 | Med | 0.33 | 6.1 | 0.00 | Oct 27, 2026 | SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1,… | ||
| CVE-2026-116890 | Hig | 0.40 | 7.3 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics,… | ||
| CVE-2026-116889 | Med | 0.33 | 6.1 | 0.00 | Oct 27, 2026 | SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the… | ||
| CVE-2026-116888 | Med | 0.24 | 4.8 | 0.00 | Oct 27, 2026 | SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds… | ||
| CVE-2026-116887 | Med | 0.28 | 5.4 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an… | ||
| CVE-2026-116886 | Med | 0.28 | 5.4 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders… | ||
| CVE-2026-116885 | Med | 0.33 | 6.1 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into… | ||
| CVE-2026-116884 | Med | 0.33 | 6.1 | 0.00 | Oct 27, 2026 | SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title,… | ||
| CVE-2026-116883 | Med | 0.24 | 4.8 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to… | ||
| CVE-2026-116882 | Med | 0.31 | 4.8 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which… | ||
| CVE-2026-116881 | Med | 0.33 | 6.1 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete… | ||
| CVE-2026-116880 | Hig | 0.39 | 7.1 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers… | ||
| CVE-2026-116879 | Med | 0.28 | 5.4 | 0.00 | Oct 27, 2026 | Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to… |
- risk 0.38cvss 5.9epss 0.00
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.
- risk 0.49cvss 7.5epss 0.00
Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials.
- risk 0.49cvss 7.5epss 0.00
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
- risk 0.50cvss —epss 0.00
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is…
- risk 0.17cvss 3.7epss 0.00
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the…
- risk 0.29cvss 5.5epss 0.00
In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never…
- risk 0.59cvss —epss 0.00
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret…
- risk 0.29cvss —epss 0.00
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent…
- risk 0.52cvss 9.1epss 0.00
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash…
- risk 0.50cvss —epss 0.00
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting…
- risk 0.24cvss 4.8epss 0.00
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…
- risk 0.47cvss 7.2epss 0.00
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it…
- risk 0.57cvss —epss 0.00
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive…
- risk 0.40cvss 6.1epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS. This issue affects Kulga News Software: from v26.7.4 before v26.10.0.
- risk 0.57cvss —epss 0.00
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php),…
- risk 0.27cvss 5.3epss 0.00
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing…
- risk 0.42cvss 7.5epss 0.00
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing…
- risk 0.16cvss 3.5epss 0.00
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes…
- risk 0.20cvss 4.1epss 0.00
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link…
- risk 0.20cvss 4.1epss 0.00
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that…
- risk 0.50cvss 8.8epss 0.00
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can…
- risk 0.33cvss 6.1epss 0.00
REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking…
- risk 0.28cvss 5.4epss 0.00
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or…
- risk 0.22cvss 4.4epss 0.00
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory…
- risk 0.57cvss 9.8epss 0.01
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for…
- risk 0.44cvss 6.7epss 0.00
In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
- risk 0.56cvss —epss 0.00
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
- risk 0.50cvss —epss 0.00
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting…
- risk 0.28cvss 5.4epss 0.00
REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that…
- risk 0.35cvss 6.5epss 0.00
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the…
- risk 0.39cvss 7.1epss 0.00
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories…
- risk 0.35cvss 6.5epss 0.00
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback],…
- risk 0.42cvss 7.5epss 0.00
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain…
- risk 0.28cvss 5.4epss 0.00
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode,…
- risk 0.20cvss 4.2epss 0.00
REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie…
- risk 0.37cvss 6.8epss 0.00
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall…
- risk 0.33cvss 6.1epss 0.00
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw…
- risk 0.33cvss 6.1epss 0.00
SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1,…
- risk 0.40cvss 7.3epss 0.00
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics,…
- risk 0.33cvss 6.1epss 0.00
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the…
- risk 0.24cvss 4.8epss 0.00
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds…
- risk 0.28cvss 5.4epss 0.00
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an…
- risk 0.28cvss 5.4epss 0.00
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders…
- risk 0.33cvss 6.1epss 0.00
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into…
- risk 0.33cvss 6.1epss 0.00
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title,…
- risk 0.24cvss 4.8epss 0.00
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to…
- risk 0.31cvss 4.8epss 0.00
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which…
- risk 0.33cvss 6.1epss 0.00
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete…
- risk 0.39cvss 7.1epss 0.00
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers…
- risk 0.28cvss 5.4epss 0.00
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to…