#cwe-116

共收录 223 条相关情报。

漏洞预警2026-06-22 发布INFO

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted namin...

CVE-2026-44913

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-19 发布CRITICAL

Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names qu...

CVE-2026-12048

pgAdmin 4 在错误渲染和计划节点渲染路径中存在存储型跨站脚本（XSS）漏洞。攻击者可通过控制 PostgreSQL 服务器，或利用低权限数据库用户创建的表名、列名等对象，在返回的错误消息（如关系不存在错误中的对象名）和 EXPLAI

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-06-19 发布LOW

HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and the top-level /cl...

CVE-2026-12047

CVE-2026-12047 是 pgAdmin 4 云部署模块中的一个 HTML 注入漏洞。该漏洞源于多个端点（如 /rds/verify_credentials、/azure/check_cluster_name_availabilit

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-06-19 发布HIGH

SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-supplied description field. The Jinja templates for Domains...

CVE-2026-12044

pgAdmin 4 1.0 至 9.16 之前版本中存在多处 SQL 注入漏洞。漏洞源于在多个对话框模板（域、外键表、语言、事件触发器以及视图 OID 查询）中，Jinja 模板直接使用单引号包裹用户提供的描述字段（例如 `'{{ data

历史摘要 · 未重新核验 · NVD

#cve #cwe-89 #cwe-116

安全公告2026-06-17 发布INFO

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

CVE-2026-54013

# Stored XSS to Account Takeover via Model Profile Images in Open WebUI **Affected:** Open WebUI ` tags. On the output

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-116 #cwe-693 #severity:high

安全公告2026-06-16 发布INFO

Caddy: stripHTML template function bypass

CVE-2026-52846

### Summary Caddy’s `stripHTML` template function cannot reliably remove all HTML tags from input strings. Certain malfo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-116 #severity:medium

漏洞预警2026-06-12 发布INFO

ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with ...

CVE-2026-45011

ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vuln

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

安全公告2026-06-12 发布INFO

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

CVE-2026-44311

### Summary A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-116 #severity:medium

漏洞预警2026-06-12 发布INFO

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Vers...

CVE-2026-54133

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON doc

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-94 #cwe-116

漏洞预警2026-06-12 发布INFO

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but st...

CVE-2026-48485

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, un

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-11 发布INFO

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the latest release suppresses mentions in several moderation c...

CVE-2026-47188

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the l

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-11 发布INFO

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text i...

CVE-2026-47175

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, sever

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-11 发布INFO

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticket with a reason containing @ev...

CVE-2026-47173

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a nor

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-11 发布INFO

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @ev...

CVE-2026-47171

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a nor

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-10 发布INFO

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Sto...

CVE-2026-42558

Xibo is an open source digital signage platform with a web content management system and Windows display player software

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116 #cwe-346

漏洞预警2026-06-09 发布INFO

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hard...

CVE-2026-49472

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-09 发布INFO

A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_info.json inside a ...

CVE-2026-8795

A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94 #cwe-116

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitiz...

CVE-2026-46496

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability e

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-06-04 发布INFO

A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by suppl...

CVE-2026-20245

A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, loca

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-06-03 发布INFO

GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. ...

CVE-2026-42321

GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a tech

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116