A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVE Database V5

CVE-2026-112039: Cross Site Scripting in diem-project diem

CVE-2026-112038 is a cross-site scripting (XSS) vulnerability in the diem-project diem software affecting the html function in dmAdminPlugin/web/js/dmAdminCtrl.js within the Version Check Service component. The vulnerability allows remote attackers to inject malicious scripts. The project uses a rolling release model, so specific affected or fixed versions are not provided. The issue was reported early but has not yet received a vendor response or patch. The CVSS 4.8 score indicates medium severity.

This vulnerability is a cross-site scripting (XSS) flaw in the html function of the dmAdminPlugin/web/js/dmAdminCtrl.js file in the Version Check Service component of diem-project diem. It allows remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability is publicly disclosed and exploitable remotely. The project follows a rolling release approach, so no explicit affected or fixed versions are specified. The vendor has been informed but has not yet provided a fix or response.

CVE-2026-112038 is a cross-site scripting (XSS) vulnerability in the diem-project diem software affecting the html function in dmAdminPlugin/web/js/dmAdminCtrl.js within the Version Check Service component. The vulnerability allows remote attackers to inject malicious scripts. The project uses a rol

CVE-2026-112038: Cross Site Scripting in diem-project diem

CVE-2026-112037 is a medium severity vulnerability in the diem-project diem involving improper certificate validation in a Google Analytics Client component. The flaw exists in an unknown function within dmCorePlugin/lib/vendor/gapi/gapi.class.php. The vulnerability can be exploited remotely but requires a high level of complexity and is difficult to exploit. The project operates on a rolling release basis, so no specific affected or fixed versions are identified. The issue was reported early, but no vendor response or patch is currently available.

This vulnerability in diem-project diem affects an unknown function in the Google Analytics Client component (dmCorePlugin/lib/vendor/gapi/gapi.class.php) and results in improper certificate validation. The flaw allows remote attackers to potentially manipulate certificate validation processes. Exploitation is considered difficult and requires high complexity. The product uses a rolling release model, so no discrete version numbers are provided for affected or fixed releases. The vendor has been notified but has not yet responded or issued a fix. The CVSS 4.0 base score is 6.3, indicating medium severity.

CVE-2026-112037 is a medium severity vulnerability in the diem-project diem involving improper certificate validation in a Google Analytics Client component. The flaw exists in an unknown function within dmCorePlugin/lib/vendor/gapi/gapi.class.php. The vulnerability can be exploited remotely but req

CVE-2026-112037: Improper Certificate Validation in diem-project diem

CVE-2026-108984 is a high-severity stack-based buffer overflow vulnerability in GeoVision Inc.'s GV-ASManager product, specifically affecting version 6.3.0. The flaw exists in the Web Server default connection ports handled by the process GeoWebServer.exe. This vulnerability can cause denial of service due to application crashes but does not impact confidentiality or integrity.

This vulnerability is a stack-based buffer overflow (CWE-121) in the GeoWebServer.exe process of GeoVision Inc.'s GV-ASManager software. It affects version 6.3.0 and involves the Web Server default connection ports. The CVSS 3.1 score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service). There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild. No patch or remediation information is provided.

CVE-2026-108984 is a high-severity stack-based buffer overflow vulnerability in GeoVision Inc.'s GV-ASManager product, specifically affecting version 6.3.0. The flaw exists in the Web Server default connection ports handled by the process GeoWebServer.exe. This vulnerability can cause denial of serv

CVE-2026-108984: CWE-121 Stack-based buffer overflow in GeoVision Inc. GV-ASManager

CVE-2026-108983 is a critical OS command injection vulnerability in GeoVision Inc.'s GV-ASManager product. It affects version 6.3.0 and involves improper neutralization of special elements in the Web Server default connection ports handled by the GeoWebServer.exe process. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

This vulnerability (CWE-78) exists in the GeoWebServer.exe process of GeoVision Inc.'s GV-ASManager product, specifically in the Web Server default connection ports. It allows an attacker to inject OS commands due to improper neutralization of special elements, potentially leading to full system compromise. The affected version is 6.3.0. No patch or remediation information is provided in the available data.

CVE-2026-108983 is a critical OS command injection vulnerability in GeoVision Inc.'s GV-ASManager product. It affects version 6.3.0 and involves improper neutralization of special elements in the Web Server default connection ports handled by the GeoWebServer.exe process. The vulnerability has a CVS

CVE-2026-108983: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in GeoVision Inc. GV-ASManager

CVE-2026-23588 is a reported vulnerability with no publicly available technical details or description. There is no information about affected software versions, impact, or exploitation. No patch or remediation information is provided.

This entry identifies CVE-2026-23588 as a vulnerability record without any accompanying technical details, affected versions, or impact description. No CVSS score or vendor advisory information is available to clarify the nature or severity of the vulnerability.

GCVE Database

Detailed information about Rejected reason: Withdrawn by requester. (CVE-2026-23588). Get real-time updates, technical details, and mitigation strategies.

CVE-2026-23588

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional