Tagged “cve.org”
CVEs tagged cve.org, newest first.
49927 CVEsRSS
CVE-2026-112239High· 7.2Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user ca…
CVE-2026-112071Medium· 6.9PoCBroken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a …
CVE-2026-113442Medium· 5.3Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
CVE-2026-112238High· 8.7SQL Injection in extension "File manager" (ameos_filemanager)
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore le…
CVE-2026-112237Medium· 6.9Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully …
CVE-2026-112067Medium· 6.9Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This appli…
CVE-2026-113381High· 7.3PoCOsclass Item Model Item.php findUserItems sql injection
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argume…
CVE-2026-112068Medium· 5.3Insecure Direct Object Reference in extension "Analytics" (analytics)
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
CVE-2026-112066High· 7.1Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
CVE-2026-112065Medium· 5.3Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve con…
CVE-2026-112064High· 7.1SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A…
CVE-2026-108062Medium· 6.9Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
CVE-2026-107597Medium· 5.1jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the appr…
CVE-2026-111844Medium· 6.5WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.
CVE-2026-113382Medium· 6.3arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload
A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argume…
CVE-2026-112783Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary …
CVE-2026-113352High· 7.5uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant …
CVE-2026-112786Medium· 5.4OpenCATS before 0.10.0 Missing Authorization via Import Revert Action
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's…
CVE-2026-108088High· 7.5Apache Cocoon: Cross-user cache poisoning
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users…
CVE-2026-108087High· 8.8Apache Cocoon: SQL Injection
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would all…
CVE-2026-108086High· 7.5Apache Cocoon: XEE could lead to SSRF and information disclosure
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could l…
CVE-2026-108089High· 7.5Apache Cocoon: Unauthenticated access to diagnostic interfaces
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache,…
CVE-2026-113349Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access…
CVE-2026-112787Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeE…
CVE-2026-112785Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editList…
CVE-2026-112784Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromA…
CVE-2026-113357Low· 3.5@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts…
CVE-2026-113354Medium· 6.5PoCDockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to re…
CVE-2026-113353Medium· 5.4LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated ins…
CVE-2026-113350Medium· 5.4react-admin before 5.15.5 Stored XSS via UrlField and FileField
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type …