Search vulnerabilities

Expected end of text, found '/' (at char 37), (line:1, col:38)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,694

CVE-2026-63168

Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63165

Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-129139

paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

CVSS 4.0 · 8.8 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129140

paicoding 1.0.0 through 1.0.3 Stored XSS via SVG Image Upload

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
Itwanger
Products
Paicoding
CVE-2026-129141

paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Description

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
Itwanger
Products
Paicoding
CVE-2026-129142

paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications

paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129143

paicoding 1.0.3 Missing Authorization via Article Detail API Endpoint

paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Itwanger
Products
Paicoding
CVE-2026-129144

paicoding 1.0.3 Payment Bypass via Guessable Codes in /article/api/pay/callback

paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by guessing weak payment confirmation codes. Attackers can start a payment, enumerate roughly 2000 IdUtil.genPayCode counter values, and submit the matching verifyCode to the unauthenticated callback to mark it paid.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Itwanger
Products
Paicoding
CVE-2026-129151

SurveyKing 1.13.2 Unauthenticated Survey Response Disclosure via Result Lookup

SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Surveyking
Products
Surveyking
CVE-2026-129152

SurveyKing 1.12.0 through 1.13.2 Authentication Bypass via saveAnswer Response Submission

SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Surveyking
Products
Surveyking
CVE-2026-129153

SurveyKing 1.12.0 through 1.13.2 Authorization Bypass via Linked Survey linkSurveyId

SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Surveyking
Products
Surveyking
CVE-2026-129154

SurveyKing 1.13.0 through 1.13.2 Stored XSS via Response Survey Snapshot

SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Surveyking
Products
Surveyking
CVE-2026-129155

DjangoBlog 2.0.0.0 through 2.1.0.0 Stored XSS via Comment Sanitizer class_filter

DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129156

DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions

DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129157

ragent 1.0.0 through 1.1.0 Missing Authorization via /rag/traces/runs

ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129158

ragent 1.1.0 Stored XSS via SVG Knowledge-Base Document Upload

ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129160

Dromara free-fs 2.0.1 through 2.3.1 SQL Injection via orderBy Parameter

free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129161

Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover

Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129162

Dromara free-fs 2.0.1 through 2.3.1 Missing Authentication via File Stream Preview

Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.

CVSS 4.0 · 8.2 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-129163

Dromara free-fs 2.0.1 through 2.3.1 Stored XSS via File Preview Endpoint

Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—