Open WebUI allows limited stored XSS vila uploaded html file
CVE-2025-46571
### Summary Low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend en
#severity:medium
共收录 5559 条相关情报。
← 返回所有主题A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi...
CVE-2026-12948
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify...
CVE-2026-59709
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field wh
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to...
CVE-2026-12352
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on t
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis...
CVE-2026-53877
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-read
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator`...
CVE-2026-53878
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlin
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site...
CVE-2026-11328
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src...
CVE-2026-59710
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/ta
Craft CMS: Stored XSS via Structure entry title in table view
CVE-2026-55793
# Stored XSS via Structure entry title in table view ## Summary An Author-level control panel user can store a JavaScr
showdown contains a cross-site scripting vulnerability in metadata title handling that allows...
CVE-2026-59711
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitr
Memory Corruption when updating prepared commands with invalid port indices based on user space...
CVE-2026-21384
Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported
Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during...
CVE-2026-21368
Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks.
Memory Corruption when handling flash commands due to outdated LED count values being used after...
CVE-2026-21369
Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.
Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed...
CVE-2026-21370
Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.
DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability...
CVE-2026-48267
DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an
Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.
CVE-2025-59617
Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.
Memory Corruption when invoking device input/output control operations for mapping and unmapping...
CVE-2025-59615
Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffe
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image...
CVE-2026-59089
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calc
Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input...
CVE-2025-59616
Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing alrea
ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker...
CVE-2026-9182
ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue b