Common Weakness Enumeration
CWE-791
AllowedIncomplete Filtering of Special Elements
Abstraction: Base · Status: Incomplete
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
42 vulnerabilities reference this CWE, most recent first.
CVE-2026-123020 (GCVE-0-2026-123020)
Vulnerability from cvelistv5 – Published: 2026-11-05 12:45 – Updated: 2026-11-05 20:44 X_Open Source
VLAI
EPSS
VEX
Title
eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine
Summary
A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.get_prompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claude_skill/__init__.py of the component Jinja2 Template Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is sufficient to fix this issue. The identifier of the patch is a9e7a3c026d114fcfb4ffe3eaf78851a636ded16. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:43 UTC
CWE
Assigner
VulDB
CNA
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431394 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431394/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123020 | third-party-advisory |
| https://vuldb.com/submit/1033118 | third-party-advisory |
| https://github.com/eosphoros-ai/DB-GPT/issues/3291 | issue-tracking |
| https://github.com/eosphoros-ai/DB-GPT/pull/3111 | issue-trackingpatch |
| https://github.com/ybyu-ieu/agent-security-adviso… | exploit |
| https://github.com/eosphoros-ai/DB-GPT/commit/a9e… | patch |
| https://github.com/eosphoros-ai/DB-GPT/releases/t… | patch |
| https://github.com/eosphoros-ai/DB-GPT/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| eosphoros-ai | DB-GPT |
Affected:
0.8.0
Affected: 0.8.1 Unaffected: 0.8.2 cpe:2.3:a:eosphoros-ai:db-gpt:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123020",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:43:37.671018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:44:10.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/eosphoros-ai/DB-GPT/issues/3291"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:eosphoros-ai:db-gpt:*:*:*:*:*:*:*:*"
],
"modules": [
"Jinja2 Template Handler"
],
"product": "DB-GPT",
"vendor": "eosphoros-ai",
"versions": [
{
"status": "affected",
"version": "0.8.0"
},
{
"status": "affected",
"version": "0.8.1"
},
{
"status": "unaffected",
"version": "0.8.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ybyu (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.get_prompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claude_skill/__init__.py of the component Jinja2 Template Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is sufficient to fix this issue. The identifier of the patch is a9e7a3c026d114fcfb4ffe3eaf78851a636ded16. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T12:45:21.513Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431394 | eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431394"
},
{
"name": "VDB-431394 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431394/cti"
},
{
"name": "CVE-2026-123020 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123020"
},
{
"name": "Submit #1033118 | eosphoros-ai DB-GPT 0.8.1 CWE-1336 Improper Neutralization of Special Elements Used in a T",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033118"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/eosphoros-ai/DB-GPT/issues/3291"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/eosphoros-ai/DB-GPT/pull/3111"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-skill-template-jinja2-ssti-rce.md"
},
{
"tags": [
"patch"
],
"url": "https://github.com/eosphoros-ai/DB-GPT/commit/a9e7a3c026d114fcfb4ffe3eaf78851a636ded16"
},
{
"tags": [
"patch"
],
"url": "https://github.com/eosphoros-ai/DB-GPT/releases/tag/v0.8.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/eosphoros-ai/DB-GPT/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-05T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-05T07:23:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123020",
"datePublished": "2026-11-05T12:45:21.513Z",
"dateReserved": "2026-11-05T06:17:58.263Z",
"dateUpdated": "2026-11-05T20:44:10.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121446 (GCVE-0-2026-121446)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-07 03:04
VLAI
EPSS
VEX
Title
svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes
Summary
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:03 UTC
CWE
- CWE-791 - Incomplete Filtering of Special Elements
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/darylldoyle/svg-sanitizer/secu… | vendor-advisory |
| https://www.vulncheck.com/advisories/svg-sanitize… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| darylldoyle | svg-sanitizer |
Affected:
0.5.0 , < 1.1.0
(semver)
Unaffected: 1.1.0 (semver) cpe:2.3:a:drupal:svg_sanitizer:*:*:*:*:*:*:*:* |
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121446",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:03:46.540150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:04:07.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-3vh3-jf65-656w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "svg-sanitizer",
"vendor": "darylldoyle",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:svg_sanitizer:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "0.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Rudloff"
},
{
"lang": "en",
"type": "reporter",
"value": "AlpetGexha"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:35.374Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3vh3-jf65-656w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-3vh3-jf65-656w"
},
{
"name": "VulnCheck Advisory: svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/svg-sanitizer-0.5.0-before-1.1.0-incomplete-url-filtering-in-svg-attributes"
}
],
"title": "svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121446",
"datePublished": "2026-11-03T14:28:35.374Z",
"dateReserved": "2026-11-03T12:33:53.716Z",
"dateUpdated": "2026-11-07T03:04:07.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108570 (GCVE-0-2026-108570)
Vulnerability from cvelistv5 – Published: 2026-10-11 10:30 – Updated: 2026-10-13 13:02
VLAI
EPSS
VEX
Title
Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine
Summary
A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:02 UTC
CWE
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416227 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416227/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108570 | third-party-advisory |
| https://vuldb.com/submit/954714 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Furion | .NET Framework |
Affected:
4.9.9.0
Affected: 4.9.9.1 Affected: 4.9.9.2 Affected: 4.9.9.3 Affected: 4.9.9.4 Affected: 4.9.9.5 Affected: 4.9.9.6 Affected: 4.9.9.7 Affected: 4.9.9.8 Affected: 4.9.9.9 Affected: 4.9.9.10 Affected: 4.9.9.11 Affected: 4.9.9.12 Affected: 4.9.9.13 Affected: 4.9.9.14 Affected: 4.9.9.15 Affected: 4.9.9.16 Affected: 4.9.9.17 Affected: 4.9.9.18 Affected: 4.9.9.19 Affected: 4.9.9.20 Affected: 4.9.9.21 Affected: 4.9.9.22 Affected: 4.9.9.23 Affected: 4.9.9.24 Affected: 4.9.9.25 Affected: 4.9.9.26 Affected: 4.9.9.27 Affected: 4.9.9.28 Affected: 4.9.9.29 Affected: 4.9.9.30 Affected: 4.9.9.31 Affected: 4.9.9.32 Affected: 4.9.9.33 Affected: 4.9.9.34 Affected: 4.9.9.35 Affected: 4.9.9.36 Affected: 4.9.9.37 Affected: 4.9.9.38 Affected: 4.9.9.39 Affected: 4.9.9.40 Affected: 4.9.9.41 Affected: 4.9.9.42 Affected: 4.9.9.43 Affected: 4.9.9.44 Affected: 4.9.9.45 Affected: 4.9.9.46 Affected: 4.9.9.47 Affected: 4.9.9.48 Affected: 4.9.9.49 Affected: 4.9.9.50 Affected: 4.9.9.51 Affected: 4.9.9.52 Affected: 4.9.9.53 Affected: 4.9.9.54 Affected: 4.9.9.55 Affected: 4.9.9.56 Affected: 4.9.9.57 Affected: 4.9.9.58 Affected: 4.9.9.59 Affected: 4.9.9.60 Affected: 4.9.9.61 Affected: 4.9.9.62 Affected: 4.9.9.63 Affected: 4.9.9.64 Affected: 4.9.9.65 Affected: 4.9.9.66 Affected: 4.9.9.67 Affected: 4.9.9.68 Affected: 4.9.9.69 Affected: 4.9.9.70 Affected: 4.9.9.71 Affected: 4.9.9.72 Affected: 4.9.9.73 Affected: 4.9.9.74 Affected: 4.9.9.75 Affected: 4.9.9.76 Affected: 4.9.9.77 Affected: 4.9.9.78 Affected: 4.9.9.79 Affected: 4.9.9.80 Affected: 4.9.9.81 Affected: 4.9.9.82 Affected: 4.9.9.83 Affected: 4.9.9.84 Affected: 4.9.9.85 Affected: 4.9.9.86 Affected: 4.9.9.87 Affected: 4.9.9.88 Affected: 4.9.9.89 Affected: 4.9.9.90 Affected: 4.9.9.91 Affected: 4.9.9.92 Affected: 4.9.9.93 Affected: 4.9.9.94 Affected: 4.9.9.95 cpe:2.3:a:furion:.net_framework:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108570",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:02:01.242393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:02:30.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/954714"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:furion:.net_framework:*:*:*:*:*:*:*:*"
],
"modules": [
"View Engine"
],
"product": ".NET Framework",
"vendor": "Furion",
"versions": [
{
"status": "affected",
"version": "4.9.9.0"
},
{
"status": "affected",
"version": "4.9.9.1"
},
{
"status": "affected",
"version": "4.9.9.2"
},
{
"status": "affected",
"version": "4.9.9.3"
},
{
"status": "affected",
"version": "4.9.9.4"
},
{
"status": "affected",
"version": "4.9.9.5"
},
{
"status": "affected",
"version": "4.9.9.6"
},
{
"status": "affected",
"version": "4.9.9.7"
},
{
"status": "affected",
"version": "4.9.9.8"
},
{
"status": "affected",
"version": "4.9.9.9"
},
{
"status": "affected",
"version": "4.9.9.10"
},
{
"status": "affected",
"version": "4.9.9.11"
},
{
"status": "affected",
"version": "4.9.9.12"
},
{
"status": "affected",
"version": "4.9.9.13"
},
{
"status": "affected",
"version": "4.9.9.14"
},
{
"status": "affected",
"version": "4.9.9.15"
},
{
"status": "affected",
"version": "4.9.9.16"
},
{
"status": "affected",
"version": "4.9.9.17"
},
{
"status": "affected",
"version": "4.9.9.18"
},
{
"status": "affected",
"version": "4.9.9.19"
},
{
"status": "affected",
"version": "4.9.9.20"
},
{
"status": "affected",
"version": "4.9.9.21"
},
{
"status": "affected",
"version": "4.9.9.22"
},
{
"status": "affected",
"version": "4.9.9.23"
},
{
"status": "affected",
"version": "4.9.9.24"
},
{
"status": "affected",
"version": "4.9.9.25"
},
{
"status": "affected",
"version": "4.9.9.26"
},
{
"status": "affected",
"version": "4.9.9.27"
},
{
"status": "affected",
"version": "4.9.9.28"
},
{
"status": "affected",
"version": "4.9.9.29"
},
{
"status": "affected",
"version": "4.9.9.30"
},
{
"status": "affected",
"version": "4.9.9.31"
},
{
"status": "affected",
"version": "4.9.9.32"
},
{
"status": "affected",
"version": "4.9.9.33"
},
{
"status": "affected",
"version": "4.9.9.34"
},
{
"status": "affected",
"version": "4.9.9.35"
},
{
"status": "affected",
"version": "4.9.9.36"
},
{
"status": "affected",
"version": "4.9.9.37"
},
{
"status": "affected",
"version": "4.9.9.38"
},
{
"status": "affected",
"version": "4.9.9.39"
},
{
"status": "affected",
"version": "4.9.9.40"
},
{
"status": "affected",
"version": "4.9.9.41"
},
{
"status": "affected",
"version": "4.9.9.42"
},
{
"status": "affected",
"version": "4.9.9.43"
},
{
"status": "affected",
"version": "4.9.9.44"
},
{
"status": "affected",
"version": "4.9.9.45"
},
{
"status": "affected",
"version": "4.9.9.46"
},
{
"status": "affected",
"version": "4.9.9.47"
},
{
"status": "affected",
"version": "4.9.9.48"
},
{
"status": "affected",
"version": "4.9.9.49"
},
{
"status": "affected",
"version": "4.9.9.50"
},
{
"status": "affected",
"version": "4.9.9.51"
},
{
"status": "affected",
"version": "4.9.9.52"
},
{
"status": "affected",
"version": "4.9.9.53"
},
{
"status": "affected",
"version": "4.9.9.54"
},
{
"status": "affected",
"version": "4.9.9.55"
},
{
"status": "affected",
"version": "4.9.9.56"
},
{
"status": "affected",
"version": "4.9.9.57"
},
{
"status": "affected",
"version": "4.9.9.58"
},
{
"status": "affected",
"version": "4.9.9.59"
},
{
"status": "affected",
"version": "4.9.9.60"
},
{
"status": "affected",
"version": "4.9.9.61"
},
{
"status": "affected",
"version": "4.9.9.62"
},
{
"status": "affected",
"version": "4.9.9.63"
},
{
"status": "affected",
"version": "4.9.9.64"
},
{
"status": "affected",
"version": "4.9.9.65"
},
{
"status": "affected",
"version": "4.9.9.66"
},
{
"status": "affected",
"version": "4.9.9.67"
},
{
"status": "affected",
"version": "4.9.9.68"
},
{
"status": "affected",
"version": "4.9.9.69"
},
{
"status": "affected",
"version": "4.9.9.70"
},
{
"status": "affected",
"version": "4.9.9.71"
},
{
"status": "affected",
"version": "4.9.9.72"
},
{
"status": "affected",
"version": "4.9.9.73"
},
{
"status": "affected",
"version": "4.9.9.74"
},
{
"status": "affected",
"version": "4.9.9.75"
},
{
"status": "affected",
"version": "4.9.9.76"
},
{
"status": "affected",
"version": "4.9.9.77"
},
{
"status": "affected",
"version": "4.9.9.78"
},
{
"status": "affected",
"version": "4.9.9.79"
},
{
"status": "affected",
"version": "4.9.9.80"
},
{
"status": "affected",
"version": "4.9.9.81"
},
{
"status": "affected",
"version": "4.9.9.82"
},
{
"status": "affected",
"version": "4.9.9.83"
},
{
"status": "affected",
"version": "4.9.9.84"
},
{
"status": "affected",
"version": "4.9.9.85"
},
{
"status": "affected",
"version": "4.9.9.86"
},
{
"status": "affected",
"version": "4.9.9.87"
},
{
"status": "affected",
"version": "4.9.9.88"
},
{
"status": "affected",
"version": "4.9.9.89"
},
{
"status": "affected",
"version": "4.9.9.90"
},
{
"status": "affected",
"version": "4.9.9.91"
},
{
"status": "affected",
"version": "4.9.9.92"
},
{
"status": "affected",
"version": "4.9.9.93"
},
{
"status": "affected",
"version": "4.9.9.94"
},
{
"status": "affected",
"version": "4.9.9.95"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "BlackSpdier (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T10:30:14.538Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416227 | Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416227"
},
{
"name": "VDB-416227 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416227/cti"
},
{
"name": "CVE-2026-108570 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108570"
},
{
"name": "Submit #954714 | \u767e\u7b7e\u79d1\u6280\uff08\u5e7f\u4e1c\uff09\u6709\u9650\u516c\u53f8 Furion v4 RCE",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/954714"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-10T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-10T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-10T17:19:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108570",
"datePublished": "2026-10-11T10:30:14.538Z",
"dateReserved": "2026-10-10T15:14:25.303Z",
"dateUpdated": "2026-10-13T13:02:30.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103540 (GCVE-0-2026-103540)
Vulnerability from cvelistv5 – Published: 2026-10-01 05:15 – Updated: 2026-10-01 19:10
VLAI
EPSS
VEX
Title
formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
Summary
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:09 UTC
CWE
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/412350 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/412350/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-103540 | third-party-advisory |
| https://vuldb.com/submit/957845 | third-party-advisory |
| https://github.com/formtools/core/issues/956 | issue-tracking |
| https://github.com/wawyw/cve_report/blob/main/for… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| formtools.org | Form Tools |
Affected:
3.1.0
Affected: 3.1.1 cpe:2.3:a:form_tools:form_tools:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103540",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:09:46.335943Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:10:09.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:form_tools:form_tools:*:*:*:*:*:*:*:*"
],
"modules": [
"Client Settings"
],
"product": "Form Tools",
"vendor": "formtools.org",
"versions": [
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wenyouwen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T05:15:13.128Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-412350 | formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/412350"
},
{
"name": "VDB-412350 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/412350/cti"
},
{
"name": "CVE-2026-103540 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-103540"
},
{
"name": "Submit #957845 | formtools.org / Form Tools project Form Tools Core 3.1.1 Server Side Template Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/957845"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/formtools/core/issues/956"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wawyw/cve_report/blob/main/formtools_1.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-30T21:12:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-103540",
"datePublished": "2026-10-01T05:15:13.128Z",
"dateReserved": "2026-09-30T19:07:30.951Z",
"dateUpdated": "2026-10-01T19:10:09.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102771 (GCVE-0-2026-102771)
Vulnerability from cvelistv5 – Published: 2026-09-29 22:00 – Updated: 2026-09-30 14:01
VLAI
EPSS
VEX
Title
Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine
Summary
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:01 UTC
CWE
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/411468 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/411468/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-102771 | third-party-advisory |
| https://vuldb.com/submit/943081 | third-party-advisory |
| https://github.com/coolcj-stack/ThinkCMF-v8.0.1-S… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102771",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:01:12.532757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T14:01:20.255Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:thinkcmf:thinkcmf:*:*:*:*:*:*:*:*"
],
"modules": [
"Email Template"
],
"product": "ThinkCMF",
"vendor": "Naichen",
"versions": [
{
"status": "affected",
"version": "8.0.0"
},
{
"status": "affected",
"version": "8.0.1"
},
{
"status": "affected",
"version": "8.0.2"
},
{
"status": "affected",
"version": "8.0.3"
},
{
"status": "affected",
"version": "8.0.4"
},
{
"status": "affected",
"version": "8.0.5"
},
{
"status": "affected",
"version": "8.0.6"
},
{
"status": "affected",
"version": "8.0.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "BlackSpdier (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T22:00:14.241Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411468 | Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/411468"
},
{
"name": "VDB-411468 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411468/cti"
},
{
"name": "CVE-2026-102771 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102771"
},
{
"name": "Submit #943081 | Naichen (Shanghai) Information Technology Co., Ltd. ThinkCMF v8.0.1 Server-Side Template Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/943081"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/coolcj-stack/ThinkCMF-v8.0.1-SSTI-Vulnerability/blob/main/ThinkCMF_Vulnerability_Report_EN.docx"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-29T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-29T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-29T18:40:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102771",
"datePublished": "2026-09-29T22:00:14.241Z",
"dateReserved": "2026-09-29T16:34:50.898Z",
"dateUpdated": "2026-09-30T14:01:20.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86206 (GCVE-0-2026-86206)
Vulnerability from cvelistv5 – Published: 2026-09-05 19:17 – Updated: 2026-09-08 10:35
VLAI
EPSS
VEX
Title
Access control filter bypass allows unauthorised access to APIs
Summary
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 10:29 UTC
CWE
- CWE-791 - Incomplete filtering of special elements
Assigner
N-able
CNA
References
2 references
| URL | Tags |
|---|---|
| https://documentation.n-able.com/N-central/Releas… | release-notes |
| https://me.n-able.com/s/security-advisory/aArVy00… | vendor-advisory |
Impacted products
Date Public
2026-09-05 19:16
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T10:29:40.266568Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T10:35:05.145Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "N-central",
"vendor": "N-able",
"versions": [
{
"lessThan": "2026.3.1.13",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Tigges of Huntress"
},
{
"lang": "en",
"type": "finder",
"value": "Stephen Fewer, Senior Principal Researcher, Rapid7"
}
],
"datePublic": "2026-09-05T19:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eA vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4"
}
],
"impacts": [
{
"capecId": "CAPEC-3",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-3 Using Leading \u0027Ghost\u0027 Character Sequences to Bypass Input Filters"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "CWE-791 Incomplete filtering of special elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:59:03.656Z",
"orgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
"shortName": "N-able"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Access control filter bypass allows unauthorised access to APIs",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
"assignerShortName": "N-able",
"cveId": "CVE-2026-86206",
"datePublished": "2026-09-05T19:17:50.920Z",
"dateReserved": "2026-09-05T12:27:20.554Z",
"dateUpdated": "2026-09-08T10:35:05.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78140 (GCVE-0-2026-78140)
Vulnerability from cvelistv5 – Published: 2026-08-23 19:45 – Updated: 2026-08-24 19:51
VLAI
EPSS
VEX
Title
Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine
Summary
A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 19:51 UTC
CWE
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394523 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394523/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78140 | third-party-advisory |
| https://vuldb.com/submit/882065 | third-party-advisory |
| https://github.com/d0ctorsec/CVE-Reports/blob/mai… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78140",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T19:51:38.400550Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T19:51:47.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ujcms:ujcms:*:*:*:*:*:*:*:*"
],
"modules": [
"web-file-template Endpoint"
],
"product": "UJCMS",
"vendor": "Dromara",
"versions": [
{
"status": "affected",
"version": "10.1.0"
},
{
"status": "affected",
"version": "10.1.1"
},
{
"status": "affected",
"version": "10.1.2"
},
{
"status": "affected",
"version": "10.1.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dactar (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T19:45:07.529Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394523 | Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394523"
},
{
"name": "VDB-394523 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394523/cti"
},
{
"name": "CVE-2026-78140 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78140"
},
{
"name": "Submit #882065 | dromara ujcms 10.1.3 Server-Side Template Injection (SSTI)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/882065"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/d0ctorsec/CVE-Reports/blob/main/CVE-UJCMS-v10.1.3-FreeMarker-SSTI/CVE-UJCMS-v10.1.3-FreeMarker-SSTI.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T07:49:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78140",
"datePublished": "2026-08-23T19:45:07.529Z",
"dateReserved": "2026-08-23T05:44:39.453Z",
"dateUpdated": "2026-08-24T19:51:47.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75979 (GCVE-0-2026-75979)
Vulnerability from cvelistv5 – Published: 2026-08-19 00:45 – Updated: 2026-08-21 21:49
VLAI
EPSS
VEX
Title
xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
Summary
A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:35 UTC
CWE
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391897 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391897/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-75979 | third-party-advisory |
| https://vuldb.com/submit/877844 | third-party-advisory |
| https://github.com/xianrendzw/EasyReport/issues/82 | exploitissue-tracking |
| https://github.com/xianrendzw/EasyReport/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75979",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:35:48.904423Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:49:58.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"SQL Preview Endpoint"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ana10gy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T00:45:08.237Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391897 | xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391897"
},
{
"name": "VDB-391897 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391897/cti"
},
{
"name": "CVE-2026-75979 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-75979"
},
{
"name": "Submit #877844 | xianrendzw EasyReport \u003c=2.0.17.0522_Beta remote code execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/877844"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/xianrendzw/EasyReport/issues/82"
},
{
"tags": [
"product"
],
"url": "https://github.com/xianrendzw/EasyReport/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-18T20:24:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-75979",
"datePublished": "2026-08-19T00:45:08.237Z",
"dateReserved": "2026-08-18T18:19:04.585Z",
"dateUpdated": "2026-08-21T21:49:58.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48208 (GCVE-0-2026-48208)
Vulnerability from cvelistv5 – Published: 2026-06-01 03:32 – Updated: 2026-06-01 13:19
VLAI
EPSS
VEX
Title
Denial-of-Service via SVG Rendering in Ticket
Summary
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).
This issue affects OTRS:
* 7.0.X
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.4.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 13:19 UTC
Assigner
OTRS
CNA
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| OTRS AG | OTRS |
Affected:
7.0.x
Affected: 8.0.x Affected: 2023.x Affected: 2024.x Affected: 2025.x Affected: 2026.x , ≤ 2026.3.x (patch) |
|
| OTRS AG | ((OTRS)) Community Edition |
Affected:
6.x
|
Date Public
2026-06-01 07:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T13:19:13.837405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T13:19:22.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Agent Frontend",
"External Interface"
],
"product": "OTRS",
"vendor": "OTRS AG",
"versions": [
{
"status": "affected",
"version": "7.0.x"
},
{
"status": "affected",
"version": "8.0.x"
},
{
"status": "affected",
"version": "2023.x"
},
{
"status": "affected",
"version": "2024.x"
},
{
"status": "affected",
"version": "2025.x"
},
{
"lessThanOrEqual": "2026.3.x",
"status": "affected",
"version": "2026.x",
"versionType": "patch"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Agent Frontend",
"External Interface"
],
"product": "((OTRS)) Community Edition",
"vendor": "OTRS AG",
"versions": [
{
"status": "affected",
"version": "6.x"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Special thanks to Daniel Triznafor reporting this vulnerability"
}
],
"datePublic": "2026-06-01T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThis issue affects OTRS:\u003c/p\u003e\u003cul\u003e\u003cli\u003e7.0.X\u003c/li\u003e\u003cli\u003e8.0.X\u003c/li\u003e\u003cli\u003e2023.X\u003c/li\u003e\u003cli\u003e2024.X\u003c/li\u003e\u003cli\u003e2025.X\u003c/li\u003e\u003cli\u003e2026.X before 2026.4.X\u003c/li\u003e\u003c/ul\u003ePlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected\u003cp\u003e\u003c/p\u003e"
}
],
"value": "An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).\n\nThis issue affects OTRS:\n\n * 7.0.X\n * 8.0.X\n * 2023.X\n * 2024.X\n * 2025.X\n * 2026.X before 2026.4.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected"
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "CWE-791 Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T03:32:38.926Z",
"orgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
"shortName": "OTRS"
},
"references": [
{
"url": "https://otrs.com/release-notes/otrs-security-advisory-2026-07/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to OTRS 2026.4.1. or later. Please note that there will be no OTRS 7 patches\u003cbr\u003e"
}
],
"value": "Update to OTRS 2026.4.1. or later. Please note that there will be no OTRS 7 patches"
}
],
"source": {
"advisory": "OSA-2026-07",
"defect": [
"Ticket#2026052110000251",
"Issue#4802"
],
"discovery": "EXTERNAL"
},
"title": "Denial-of-Service via SVG Rendering in Ticket",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
"assignerShortName": "OTRS",
"cveId": "CVE-2026-48208",
"datePublished": "2026-06-01T03:32:38.926Z",
"dateReserved": "2026-05-21T12:12:49.645Z",
"dateUpdated": "2026-06-01T13:19:22.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44232 (GCVE-0-2026-44232)
Vulnerability from cvelistv5 – Published: 2026-05-12 20:28 – Updated: 2026-06-18 22:54
VLAI
EPSS
VEX
Title
dssrf: every IPv6 category bypasses is_url_safe
Summary
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe. This vulnerability is fixed in 1.0.3.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-18 14:40 UTC
CWE
- CWE-791 - Incomplete Filtering of Special Elements
Assigner
GitHub_M
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/HackingRepo/dssrf-js/security/… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HackingRepo | dssrf-js |
Affected:
< 1.0.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44232",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:40:44.104873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T14:41:08.553Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-8p33-q827-ghj5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dssrf-js",
"vendor": "HackingRepo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe. This vulnerability is fixed in 1.0.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "CWE-791: Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T22:54:50.369Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-8p33-q827-ghj5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-8p33-q827-ghj5"
}
],
"source": {
"advisory": "GHSA-8p33-q827-ghj5",
"discovery": "UNKNOWN"
},
"title": "dssrf: every IPv6 category bypasses is_url_safe"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44232",
"datePublished": "2026-05-12T20:28:56.918Z",
"dateReserved": "2026-05-05T15:42:40.518Z",
"dateUpdated": "2026-06-18T22:54:50.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.