CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule

CVE-2026-45138

## Summary The custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (

历史摘要 · 未重新核验 · GitHub Advisory

AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`

CVE-2026-45619

CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (re

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

CVE-2026-45610

## Summary **Type:** Cross-site request forgery on the 2FA toggle. `plugin/LoginControl/set.json.php` accepts `POST typ

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

CVE-2026-45580

## Summary **Type:** Stored cross-site scripting. The Live plugin's "YouTube-style" view renders the live transmission'

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

CVE-2026-45578

## Summary **Type:** Classic shell-metacharacter injection. The YPTSocket notification branch in `plugin/Live/on_publis

历史摘要 · 未重新核验 · GitHub Advisory

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shar...

## Summary **Type:** Authorization-bypass via user-controlled identifier. The Meet plugin's recorded-video upload endpo

历史摘要 · 未重新核验 · GitHub Advisory

SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion

CVE-2026-46491

## Summary `simplesamlphp-module-casserver` builds file paths for the file-based CAS ticket store by directly concatena

历史摘要 · 未重新核验 · GitHub Advisory

Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

CVE-2026-44692

Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then re

历史摘要 · 未重新核验 · GitHub Advisory

NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

CVE-2026-41147

### Impact NukeViet CMS `, which are stored server-side and executed in the browser of any user who views the content.

历史摘要 · 未重新核验 · GitHub Advisory

SimpleSAMLphp casserver: Open Redirect in logout

CVE-2025-65954

### Summary The logout endpoint accepts a `url` query parameter to redirect to. casserver treats that url as trusted,

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

CVE-2026-44738

## Summary The Twig sandbox allow-list permits any user with the `admin.pages` role to call `config.toArray()` from wit

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT Vulnerable to Stored XSS in File Download

CVE-2026-44657

Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an attacker can ex

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT has Stored XSS on Move Attachments Admin Page

CVE-2026-44655

Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access leve

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT has a Private Bugnote Attachment Content Leak via REST API

CVE-2026-42071

A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to downlo

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

CVE-2026-42070

The mc_issue_update() function in MantisBT allows users having *update_bug_threshold* access (UPDATER, with default sett

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field

CVE-2026-41897

Lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Pag

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

CVE-2026-40607

Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_r

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

CVE-2026-40598

Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject H

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT has a Content Security Policy bypass via attachments

CVE-2026-40597

Given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's _script-

历史摘要 · 未重新核验 · GitHub Advisory

MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference

CVE-2026-40596

Any authenticated user can inject arbitrary HTML via updating their account's font family. ### Impact Cross-site script

历史摘要 · 未重新核验 · GitHub Advisory