Podatności

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in…

CVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share…

CVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to…

CVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR…

CVSS 5,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling…

CVSS 5,1 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img…

CVSS 5,1 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom…

CVSS 5,1 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description…

CVSS 5,1 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving…

CVSS 5,1 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers…

CVSS 5,1 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages,…

CVSS 5,1 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.

CVSS 5,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in the…

CVSS 5,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The…

CVSS 5,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the…

CVSS 5,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject…

CVSS 5,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view…

CVSS 5,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields…

CVSS 5,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

CVSS 5,1 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

CVSS 5,1 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.

CVSS 5,1 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.

CVSS 5,1 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.

CVSS 5,1 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.

CVSS 5,1 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.

CVSS 5,1 · EPSS 0,11 % · rekomendacja wg zapisanej polityki