LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

## Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTM

历史摘要 · 未重新核验 · GitHub Advisory

cakephp/debug_kit: MailPreview contains unsafe reflection

CVE-2026-54614

### Impact The `MailPreview` feature of debugkit is vulnerable to arbitrary constructor execution. For an application t

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

## Overview When phpMyFAQ hardened its admin permission-assignment endpoints against privilege escalation, it added a "

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ public FAQ APIs expose inactive FAQ content

## Affected Product phpMyFAQ ## Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: curren

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

## Summary There is an authenticated path traversal condition in the PDF export functionality, specifically within the

历史摘要 · 未重新核验 · GitHub Advisory

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

CVE-2026-63135

### Summary YOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domai

历史摘要 · 未重新核验 · GitHub Advisory

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

CVE-2026-59989

## Summary The Volt template compiler in Phalcon generates the PHP for the `join` filter by string-concatenating the fi

历史摘要 · 未重新核验 · GitHub Advisory

Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin

## Summary Grav 2.0 renders editor-authored Twig in page content by default and relies on the Twig content sandbox to c

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Reflected XSS through the search query parameter in the backend Table widget

### Impact Affected versions of Winter CMS render the `search` query parameter without HTML encoding inside a `` block

历史摘要 · 未重新核验 · GitHub Advisory

Winter: CSRF through AJAX handler names reachable as backend page actions

### Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level `GET` naviga

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

### Impact Users with the `backend.manage_branding` ("Customize the back-end") or `backend.manage_editor` ("Manage glob

历史摘要 · 未重新核验 · GitHub Advisory

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

### Impact Affected versions of Winter CMS did not enforce the `ImportExportController` behavior's granular access cont

历史摘要 · 未重新核验 · GitHub Advisory

Winter: My Account preview exposes another backend user's profile by record ID

### Impact `Backend\Controllers\MyAccount`, introduced in v1.2.13, declares an empty `$requiredPermissions` array so th

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Stored XSS through Backend List widget image columns

### Impact `Backend\Widgets\Lists::evalImageTypeValue()` interpolated the resolved image URL into a single-quoted `src`

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

### Impact Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to e

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

### Impact Affected versions of Winter CMS allow authenticated backend users with the `cms.manage_assets` permission ("

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

CVE-2026-63179

### Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose

历史摘要 · 未重新核验 · GitHub Advisory

Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

CVE-2026-57570

## Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations

历史摘要 · 未重新核验 · GitHub Advisory

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

CVE-2026-62673

## Summary The default `.htaccess` shipped with Grav (and the reference `webserver-configs/htaccess.txt`) contains secu

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT: Stored DOM XSS via table selected-count IDs

CVE-2026-61807

### Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and suppli

历史摘要 · 未重新核验 · GitHub Advisory