Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
337 results · Clear filters · Feed
-
Medium 4.9
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulner…
-
Medium 6.5
The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all version…
-
Medium 4.4
The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerab…
-
Medium 5.4
OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and …
-
Medium 6.5
OpenEMR before 8.5.0 Missing Authorization via user_settings.php Global Override
OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service host…
-
Medium 5.1
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam…
-
Medium 4.3
OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation
OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or…
-
Medium 6.5
OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthe…
-
Medium 5.1
OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to exe…
-
Medium 5.1
OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to…
-
Medium 6.1
OpenEMR before 8.5.0 Reflected XSS via auto-suggest searchMode parameter
OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated …
-
Medium 4.8
OpenEMR before 8.5.0 Stored XSS via Eye Exam Defaults in eye_base.php
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php…
-
Medium 4.3
OpenEMR before 8.5.0 CSRF via Observation Form delete.php
OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to …
-
Medium 5.4
OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the f…
-
Medium 5.4
OpenEMR before 8.5.0 Stored XSS via OnsitePortalActivity tableArgs
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out o…
-
Medium 6.0
Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, uploa…
-
Medium 6.9
Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthe…
-
Medium 6.9
Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by…
-
Medium 5.4
Zipline before 4.6.2 Missing Authorization via POST /api/user/folders
Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder se…
-
Medium 6.8
Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints
Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and …
-
Medium 6.9
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variab…
-
Medium 5.8
Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or…
-
Medium 5.4
Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embe…
-
Medium 5.4
Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls
Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled…
-
Medium 6.9
Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET…
-
Medium 5.3
Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /ap…
-
Medium 5.3
OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build conf…
-
Medium 6.5
OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API
OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and su…
-
Medium 4.3
OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment …
-
Medium 5.3
Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.con…
-
Medium 4.3
Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList …
-
Medium 5.3
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other us…
-
Medium 5.3
BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attacke…
-
Medium 5.5
Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url
Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can ta…
-
Medium 6.5
FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode
FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such …
-
Medium 6.3
FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphp_handle_request() re…
-
Medium 6.3
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environ…
-
Medium 5.9
FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion
FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback tri…
-
Medium 6.9
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP…
-
Medium 5.9
FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion
FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from …