Export limit exceeded: 425694 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425694 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425694 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-63168 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-11-13 | 5.4 Medium |
| Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers. | ||||
| CVE-2026-63165 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-11-13 | 8.1 High |
| Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system. | ||||
| CVE-2026-129139 | 2026-11-13 | 8.2 High | ||
| paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account. | ||||
| CVE-2026-129140 | 1 Itwanger | 1 Paicoding | 2026-11-13 | 5.4 Medium |
| paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts. | ||||
| CVE-2026-129141 | 1 Itwanger | 1 Paicoding | 2026-11-13 | 5.4 Medium |
| paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie. | ||||
| CVE-2026-129142 | 2026-11-13 | 5.4 Medium | ||
| paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications. | ||||
| CVE-2026-129143 | 1 Itwanger | 1 Paicoding | 2026-11-13 | 7.5 High |
| paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles. | ||||
| CVE-2026-129144 | 1 Itwanger | 1 Paicoding | 2026-11-13 | 5.4 Medium |
| paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by guessing weak payment confirmation codes. Attackers can start a payment, enumerate roughly 2000 IdUtil.genPayCode counter values, and submit the matching verifyCode to the unauthenticated callback to mark it paid. | ||||
| CVE-2026-129151 | 1 Surveyking | 1 Surveyking | 2026-11-13 | 7.5 High |
| SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields. | ||||
| CVE-2026-129152 | 1 Surveyking | 1 Surveyking | 2026-11-13 | 5.3 Medium |
| SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results. | ||||
| CVE-2026-129153 | 1 Surveyking | 1 Surveyking | 2026-11-13 | 7.1 High |
| SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey. | ||||
| CVE-2026-129154 | 1 Surveyking | 1 Surveyking | 2026-11-13 | 6.1 Medium |
| SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed. | ||||
| CVE-2026-129155 | 2026-11-13 | 5.4 Medium | ||
| DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators. | ||||
| CVE-2026-129156 | 2026-11-13 | 5.4 Medium | ||
| DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers. | ||||
| CVE-2026-129157 | 2026-11-13 | 4.3 Medium | ||
| ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details. | ||||
| CVE-2026-129158 | 2026-11-13 | 5.4 Medium | ||
| ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover. | ||||
| CVE-2026-129160 | 2026-11-13 | 6.5 Medium | ||
| free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes. | ||||
| CVE-2026-129161 | 2026-11-13 | 7.4 High | ||
| Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account. | ||||
| CVE-2026-129162 | 2026-11-13 | 5.9 Medium | ||
| Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files. | ||||
| CVE-2026-129163 | 2026-11-13 | 5.4 Medium | ||
| Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account. | ||||