Common Weakness Enumeration
CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
3754 vulnerabilities reference this CWE, most recent first.
CVE-2026-115246 (GCVE-0-2026-115246)
Vulnerability from cvelistv5 – Published: 2026-10-22 13:00 – Updated: 2026-10-29 11:27
VLAI
EPSS
VEX
Title
subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting
Summary
A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file patdocmsg.php. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 11:26 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425219 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/425219/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115246 | third-party-advisory |
| https://vuldb.com/submit/1021707 | third-party-advisory |
| https://github.com/subhajitkhan/online-clinic-man… | exploitissue-tracking |
| https://github.com/subhajitkhan/online-clinic-man… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| subhajitkhan | online-clinic-management-system |
Affected:
e9ee77a8827a1446220fa07ee693dc4d9a29a578
cpe:2.3:a:subhajitkhan:online-clinic-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115246",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T11:26:12.654974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T11:27:28.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:subhajitkhan:online-clinic-management-system:*:*:*:*:*:*:*:*"
],
"product": "online-clinic-management-system",
"vendor": "subhajitkhan",
"versions": [
{
"status": "affected",
"version": "e9ee77a8827a1446220fa07ee693dc4d9a29a578"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yuanchao (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file patdocmsg.php. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:00:19.637Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425219 | subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/425219"
},
{
"name": "VDB-425219 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425219/cti"
},
{
"name": "CVE-2026-115246 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115246"
},
{
"name": "Submit #1021707 | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1021707"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/subhajitkhan/online-clinic-management-system/issues/8"
},
{
"tags": [
"product"
],
"url": "https://github.com/subhajitkhan/online-clinic-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-22T10:31:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115246",
"datePublished": "2026-10-22T13:00:19.637Z",
"dateReserved": "2026-10-22T08:26:14.530Z",
"dateUpdated": "2026-10-29T11:27:28.126Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115188 (GCVE-0-2026-115188)
Vulnerability from cvelistv5 – Published: 2026-10-26 12:33 – Updated: 2026-10-26 15:35
VLAI
EPSS
VEX
Summary
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:47 UTC
CWE
Assigner
Mautic
CNA
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115188",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:47:17.335563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:53.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"repo": "https://github.com/mautic/mautic",
"versions": [
{
"lessThan": "7.2.2",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Moath Aloufi (@m0xath)"
},
{
"lang": "en",
"type": "finder",
"value": "@iys8"
},
{
"lang": "en",
"type": "finder",
"value": "David Carliez (@DavidCarliez)"
},
{
"lang": "en",
"type": "finder",
"value": "@Forrof"
},
{
"lang": "en",
"type": "finder",
"value": "@sdrk3nD"
},
{
"lang": "en",
"type": "finder",
"value": "@Hama1cco"
},
{
"lang": "en",
"type": "finder",
"value": "Shinya Murakami (@4n86rakam1)"
},
{
"lang": "en",
"type": "finder",
"value": "Calvin (@calbebop)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Patryk Gruszka (@patrykgruszka)"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart (@escopecz)"
},
{
"lang": "en",
"type": "sponsor",
"value": "Leuchtfeuer Digital Marketing (@Leuchtfeuer)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data."
}
],
"value": "An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data."
}
],
"impacts": [
{
"capecId": "CAPEC-650",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-650 Upload a Web Shell to a Web Server"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T12:36:35.943Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299"
}
],
"source": {
"advisory": "GHSA-mxjf-pghx-h299",
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "There are no official workarounds. To mitigate this vulnerability without upgrading, remove the campaign import create permission from all users who do not strictly need it and restrict it to trusted administrators, and configure the web server at server or virtual-host level, so that it cannot be overridden by files in the application directory, to deny script execution in the media/ directory."
}
],
"value": "There are no official workarounds. To mitigate this vulnerability without upgrading, remove the campaign import create permission from all users who do not strictly need it and restrict it to trusted administrators, and configure the web server at server or virtual-host level, so that it cannot be overridden by files in the application directory, to deny script execution in the media/ directory."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2026-115188",
"datePublished": "2026-10-26T12:33:54.469Z",
"dateReserved": "2026-10-22T06:39:08.913Z",
"dateUpdated": "2026-10-26T15:35:53.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114126 (GCVE-0-2026-114126)
Vulnerability from cvelistv5 – Published: 2026-10-21 17:21 – Updated: 2026-10-28 01:28
VLAI
EPSS
VEX
Title
Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
Summary
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 01:27 UTC
CWE
Assigner
GitHub_M
CNA
References
12 references
| URL | Tags |
|---|---|
| https://github.com/storybookjs/storybook/security… | x_refsource_CONFIRM |
| https://github.com/storybookjs/storybook/pull/36726 | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/2… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/3… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/5… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/a… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/d… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/d… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/releases… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/releases… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/releases… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| storybookjs | storybook |
Affected:
>= 8.0.0, < 8.6.19
Affected: >= 9.0.0, < 9.1.21 Affected: >= 10.0.0, < 10.6.2 Affected: >= 11.0.0-alpha.0, < 11.0.0-alpha.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114126",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T01:27:43.093819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T01:28:25.264Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "storybook",
"vendor": "storybookjs",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.6.19"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.1.21"
},
{
"status": "affected",
"version": "\u003e= 10.0.0, \u003c 10.6.2"
},
{
"status": "affected",
"version": "\u003e= 11.0.0-alpha.0, \u003c 11.0.0-alpha.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer\u0027s privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:21:29.520Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77"
},
{
"name": "https://github.com/storybookjs/storybook/pull/36726",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/pull/36726"
},
{
"name": "https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da"
},
{
"name": "https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178"
},
{
"name": "https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5"
},
{
"name": "https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb"
},
{
"name": "https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e"
},
{
"name": "https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed"
},
{
"name": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2"
},
{
"name": "https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6"
},
{
"name": "https://github.com/storybookjs/storybook/releases/tag/v8.6.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/releases/tag/v8.6.19"
},
{
"name": "https://github.com/storybookjs/storybook/releases/tag/v9.1.21",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/releases/tag/v9.1.21"
}
],
"source": {
"advisory": "GHSA-px85-f4q5-jh77",
"discovery": "UNKNOWN"
},
"title": "Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-114126",
"datePublished": "2026-10-21T17:21:29.520Z",
"dateReserved": "2026-10-20T21:53:58.472Z",
"dateUpdated": "2026-10-28T01:28:25.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114125 (GCVE-0-2026-114125)
Vulnerability from cvelistv5 – Published: 2026-10-21 17:08 – Updated: 2026-10-28 17:13
VLAI
EPSS
VEX
Title
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Summary
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 17:12 UTC
CWE
Assigner
GitHub_M
CNA
References
11 references
| URL | Tags |
|---|---|
| https://github.com/storybookjs/storybook/security… | x_refsource_CONFIRM |
| https://github.com/storybookjs/storybook/pull/36726 | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/2… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/3… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/9… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/d… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/commit/d… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/releases… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/releases… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/releases… | x_refsource_MISC |
| https://github.com/storybookjs/storybook/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| storybookjs | storybook |
Affected:
>= 8.0.0, < 8.6.19
Affected: >= 9.0.0, < 9.1.21 Affected: >= 10.0.0, < 10.6.2 Affected: >= 11.0.0-alpha.0, < 11.0.0-alpha.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114125",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T17:12:45.621272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T17:13:06.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "storybook",
"vendor": "storybookjs",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.6.19"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.1.21"
},
{
"status": "affected",
"version": "\u003e= 10.0.0, \u003c 10.6.2"
},
{
"status": "affected",
"version": "\u003e= 11.0.0-alpha.0, \u003c 11.0.0-alpha.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer\u0027s privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:08:12.102Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8"
},
{
"name": "https://github.com/storybookjs/storybook/pull/36726",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/pull/36726"
},
{
"name": "https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da"
},
{
"name": "https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178"
},
{
"name": "https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0"
},
{
"name": "https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e"
},
{
"name": "https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed"
},
{
"name": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2"
},
{
"name": "https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6"
},
{
"name": "https://github.com/storybookjs/storybook/releases/tag/v8.6.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/releases/tag/v8.6.19"
},
{
"name": "https://github.com/storybookjs/storybook/releases/tag/v9.1.21",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/storybookjs/storybook/releases/tag/v9.1.21"
}
],
"source": {
"advisory": "GHSA-f2ph-cmg5-wxc8",
"discovery": "UNKNOWN"
},
"title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-114125",
"datePublished": "2026-10-21T17:08:12.102Z",
"dateReserved": "2026-10-20T21:53:58.472Z",
"dateUpdated": "2026-10-28T17:13:06.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114053 (GCVE-0-2026-114053)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-27 21:41
VLAI
EPSS
VEX
Title
vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision
Summary
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-27 21:41 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/vllm-project/vllm/security/adv… | vendor-advisory |
| https://github.com/vllm-project/vllm/commit/57073… | patch |
| https://www.vulncheck.com/advisories/vllm-0.7.3-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vllm-project | vllm |
Affected:
0.7.3 , < 0.31.0
(semver)
Unaffected: 0.31.0 (semver) cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* |
Date Public
2026-10-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T21:41:35.887656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T21:41:51.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/vllm",
"product": "vllm",
"vendor": "vllm-project",
"versions": [
{
"lessThan": "0.31.0",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.31.0",
"versionStartIncluding": "0.7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "adithyan-ak"
},
{
"lang": "en",
"type": "coordinator",
"value": "jperezdealgaba"
},
{
"lang": "en",
"type": "finder",
"value": "DarkLight1337"
}
],
"datePublic": "2026-10-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model\u0027s dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:36:29.796Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h3rc-6mm3-gc2m)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/vllm-project/vllm/commit/570735520942b6428ae98f1eb442c6d88adae55e"
},
{
"name": "VulnCheck Advisory: vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision"
}
],
"title": "vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114053",
"datePublished": "2026-10-21T00:36:29.796Z",
"dateReserved": "2026-10-20T21:42:27.669Z",
"dateUpdated": "2026-10-27T21:41:51.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113776 (GCVE-0-2026-113776)
Vulnerability from cvelistv5 – Published: 2026-10-20 22:03 – Updated: 2026-10-28 14:54
VLAI
EPSS
VEX
Title
virtualenv activation scripts run code from a path that contains a placeholder name
Summary
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value's quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 14:53 UTC
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pypa/virtualenv/security/advis… | x_refsource_CONFIRM |
| https://github.com/pypa/virtualenv/commit/602b266… | x_refsource_MISC |
| https://github.com/pypa/virtualenv/releases/tag/21.14.2 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pypa | virtualenv |
Affected:
>= 20.26.6, < 21.14.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T14:53:53.156314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T14:54:19.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003e= 20.26.6, \u003c 21.14.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value\u0027s quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T22:03:18.274Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp"
},
{
"name": "https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74"
},
{
"name": "https://github.com/pypa/virtualenv/releases/tag/21.14.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.2"
}
],
"source": {
"advisory": "GHSA-8rjx-v5ww-45pp",
"discovery": "UNKNOWN"
},
"title": "virtualenv activation scripts run code from a path that contains a placeholder name"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113776",
"datePublished": "2026-10-20T22:03:18.274Z",
"dateReserved": "2026-10-20T17:39:41.371Z",
"dateUpdated": "2026-10-28T14:54:19.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113741 (GCVE-0-2026-113741)
Vulnerability from cvelistv5 – Published: 2026-10-21 01:00 – Updated: 2026-10-21 13:40 X_Freeware
VLAI
EPSS
VEX
Title
itsourcecode Online Cake Ordering System 404.php cross site scripting
Summary
A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 13:40 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422919 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422919/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113741 | third-party-advisory |
| https://vuldb.com/submit/1017672 | third-party-advisory |
| https://github.com/milo417/submit/issues/2 | exploitissue-tracking |
| https://itsourcecode.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| itsourcecode | Online Cake Ordering System |
Affected:
1.0
cpe:2.3:a:itsourcecode:online_cake_ordering_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113741",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T13:40:27.039286Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:40:41.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:itsourcecode:online_cake_ordering_system:*:*:*:*:*:*:*:*"
],
"product": "Online Cake Ordering System",
"vendor": "itsourcecode",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "milo417 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:00:23.541Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422919 | itsourcecode Online Cake Ordering System 404.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422919"
},
{
"name": "VDB-422919 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422919/cti"
},
{
"name": "CVE-2026-113741 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113741"
},
{
"name": "Submit #1017672 | itsourcecode Online Cake Ordering System V1.0 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1017672"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/milo417/submit/issues/2"
},
{
"tags": [
"product"
],
"url": "https://itsourcecode.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:46:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "itsourcecode Online Cake Ordering System 404.php cross site scripting",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113741",
"datePublished": "2026-10-21T01:00:23.541Z",
"dateReserved": "2026-10-20T16:41:31.516Z",
"dateUpdated": "2026-10-21T13:40:41.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113718 (GCVE-0-2026-113718)
Vulnerability from cvelistv5 – Published: 2026-10-20 19:39 – Updated: 2026-10-27 13:33
VLAI
EPSS
VEX
Title
virtualenv: Xonsh activation literals depend on the script decoding codec
Summary
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-27 13:33 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pypa/virtualenv/security/advis… | x_refsource_CONFIRM |
| https://github.com/pypa/virtualenv/pull/3432 | x_refsource_MISC |
| https://github.com/pypa/virtualenv/commit/e5fc2e6… | x_refsource_MISC |
| https://github.com/pypa/virtualenv/releases/tag/21.14.9 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pypa | virtualenv |
Affected:
< 21.14.9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113718",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T13:33:30.399430Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T13:33:36.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003c 21.14.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:39:52.633Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf"
},
{
"name": "https://github.com/pypa/virtualenv/pull/3432",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/pull/3432"
},
{
"name": "https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0"
},
{
"name": "https://github.com/pypa/virtualenv/releases/tag/21.14.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"source": {
"advisory": "GHSA-394h-qwmc-48pf",
"discovery": "UNKNOWN"
},
"title": "virtualenv: Xonsh activation literals depend on the script decoding codec"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113718",
"datePublished": "2026-10-20T19:39:52.633Z",
"dateReserved": "2026-10-20T16:03:14.863Z",
"dateUpdated": "2026-10-27T13:33:36.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113388 (GCVE-0-2026-113388)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:45 – Updated: 2026-10-20 16:06 X_Open Source
VLAI
EPSS
VEX
Title
opensource-socialnetwork Cache Settings dynamic.php input code injection
Summary
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:22 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422662 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422662/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113388 | third-party-advisory |
| https://vuldb.com/submit/1009749 | third-party-advisory |
| https://gist.github.com/qianqiusujiu/c0452f09e91d… | exploit |
| https://github.com/opensource-socialnetwork/opens… | patch |
| https://github.com/opensource-socialnetwork/opens… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | opensource-socialnetwork |
Affected:
9.0
Affected: 9.1 Affected: 9.2 Affected: 9.3 Affected: 9.4 Affected: 9.5 Affected: 9.6 Affected: 9.7 Affected: 9.8 Affected: 9.9 Affected: 9.10 Affected: 9.11 Affected: 10.0 Affected: 10.1 cpe:2.3:a:opensource-socialnetwork:opensource-socialnetwork:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113388",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:22:23.938517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:06:22.411Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:opensource-socialnetwork:opensource-socialnetwork:*:*:*:*:*:*:*:*"
],
"modules": [
"Cache Settings"
],
"product": "opensource-socialnetwork",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "9.1"
},
{
"status": "affected",
"version": "9.2"
},
{
"status": "affected",
"version": "9.3"
},
{
"status": "affected",
"version": "9.4"
},
{
"status": "affected",
"version": "9.5"
},
{
"status": "affected",
"version": "9.6"
},
{
"status": "affected",
"version": "9.7"
},
{
"status": "affected",
"version": "9.8"
},
{
"status": "affected",
"version": "9.9"
},
{
"status": "affected",
"version": "9.10"
},
{
"status": "affected",
"version": "9.11"
},
{
"status": "affected",
"version": "10.0"
},
{
"status": "affected",
"version": "10.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qianqiu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: \"While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:45:15.583Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422662 | opensource-socialnetwork Cache Settings dynamic.php input code injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422662"
},
{
"name": "VDB-422662 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422662/cti"
},
{
"name": "CVE-2026-113388 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113388"
},
{
"name": "Submit #1009749 | opensource-socialnetwork Open Source Social Network (OSSN) v9.1.0.0 (master branch, commit 9983ea4) CWE-94 Remote Code Execution (RCE)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009749"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/qianqiusujiu/c0452f09e91de23f002a384038325104"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/40945057cb451f0f35153110bc7e889c094400e1"
},
{
"tags": [
"product"
],
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T07:34:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "opensource-socialnetwork Cache Settings dynamic.php input code injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113388",
"datePublished": "2026-10-20T11:45:15.583Z",
"dateReserved": "2026-10-20T05:29:08.714Z",
"dateUpdated": "2026-10-20T16:06:22.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113383 (GCVE-0-2026-113383)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:45 – Updated: 2026-10-20 13:42
VLAI
EPSS
VEX
Title
Optimal IdM OptimalCloud Login cross site scripting
Summary
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 13:41 UTC
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422656 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422656/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113383 | third-party-advisory |
| https://vuldb.com/submit/991713 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Optimal IdM | OptimalCloud |
Affected:
5.0
cpe:2.3:a:optimal_idm:optimalcloud:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T13:41:45.742122Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:42:01.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:optimal_idm:optimalcloud:*:*:*:*:*:*:*:*"
],
"product": "OptimalCloud",
"vendor": "Optimal IdM",
"versions": [
{
"status": "affected",
"version": "5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexandre Rodrigo (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:45:12.816Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422656 | Optimal IdM OptimalCloud Login cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422656"
},
{
"name": "VDB-422656 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422656/cti"
},
{
"name": "CVE-2026-113383 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113383"
},
{
"name": "Submit #991713 | Optimal IdM The OptimalCloud v5.0 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/991713"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T06:45:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "Optimal IdM OptimalCloud Login cross site scripting",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113383",
"datePublished": "2026-10-20T10:45:12.816Z",
"dateReserved": "2026-10-20T04:40:44.790Z",
"dateUpdated": "2026-10-20T13:42:01.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
Architecture and Design
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Operation
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Operation
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
Implementation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.