Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request. No optional feature or non-default configuration is required; any logged-in author or administrator is affected when induced to visit a crafted page. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates only the submitted salt and applies the same check to multipart forms.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding, causing the stored script to execute in another author's or administrator's browser. No optional feature or non-default configuration is required; this affects weblogs with multiple authors or administrators who are not mutually trusted. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which moves those values out of JavaScript literals and writes them as text.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. This affects only weblogs that use the bundled frontpage theme, and a victim must follow a crafted link for the script to execute. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates and contextually escapes the reflected parameter.
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default configuration is required; the result can redirect or break the site's public frontpage, with administrative recovery available. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts the write to global administrators.
Apache Roller 6.1.5 contains a critical deserialization vulnerability in its XML-RPC endpoint that allows unauthenticated remote attackers to cause deserialization of attacker-controlled data. This occurs because the endpoint accepts vendor extension types that are deserialized before authentication, even if the XML-RPC feature is disabled globally. This flaw can lead to remote code execution. Upgrading to Apache Roller 6.1.6 or later mitigates the issue by disabling these extension types and rejecting requests when XML-RPC is disabled.
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author supplies an enclosure URL. No non-default server configuration is required, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses, while enclosure handling exposes response status, content type, and length. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback action and stops dereferencing enclosure URLs.
Apache Roller 6.1.5 contains an XML External Entity (XXE) vulnerability that allows users with entry-editing rights to cause the server to parse attacker-controlled XML data without disabling external entity resolution. This can lead to disclosure of files readable by the Roller process. The vulnerable feature involves the Trackback response parser, which is hidden in the UI but accessible directly. Upgrading to Apache Roller 6.1.6 or later removes the vulnerable parser and mitigates the issue.
Apache Roller 6.1.5 contains a missing authorization vulnerability in its legacy XML-RPC Blogger and MetaWeblog APIs. Authenticated users can read, modify, or delete content from other weblogs because the API handlers authenticate the caller but do not verify permissions on the affected weblog or entry. This issue affects installations with the non-default global XML-RPC setting enabled. The vulnerability is fixed in Apache Roller 6.1.6 by adding explicit per-method permission checks. Users are advised to upgrade or disable the XML-RPC feature to mitigate the risk.
Apache Roller 6.1.5 contains an incorrect authorization vulnerability in its OAuth 1.0a authorization endpoint. This flaw allows an unauthenticated remote attacker who knows an outstanding request token for a configured site-wide consumer to bind that token to any user account, including administrators, by submitting an unsigned authorization request. The vulnerability arises because the endpoint derives the authorizing identity from a request-supplied value instead of the authenticated session. Only installations with an OAuth 1.0a site-wide consumer configured are affected. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by binding authorization to the logged-in session.
CVE-2026-101012 is a SQL injection vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting the makeresult.php file. The vulnerability arises from manipulation of the makeid argument, allowing remote attackers to inject SQL commands. The affected versions are not clearly identified due to continuous delivery and rolling releases, and the vendor has not responded to the disclosure. The vulnerability has a medium severity with a CVSS score of 6.9. No patch or remediation information is currently available.
Apache Roller 6.1.5 contains a vulnerability that allows a weblog administrator to read sensitive files on the application classpath, including configuration files with secrets. This is possible because the Velocity template engine's include and parse directives are not confined by the sandbox that treats weblog administrators as untrusted. The issue is fixed in Apache Roller 6.1.6, which restricts includes to the active theme and removes classpath resource loading from weblog rendering.
CVE-2026-82386 is a high-severity vulnerability in Apache Roller 6.1.5 involving improper restriction of XML External Entity (XXE) references. It allows a weblog administrator to read files accessible to the Roller process and access internal network addresses by importing a crafted OPML document. This occurs because the bookmark import parser does not disable external entity resolution. No special configuration is needed to exploit this; the vulnerability is triggered via the administrator bookmark-import action. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by using a hardened parser that disables external entities and document type declarations.
Apache Roller 6.1.5 contains an authorization bypass vulnerability that allows an authenticated user with authoring rights on one weblog to access and modify resources of another weblog. This affects multi-user installations without requiring special configuration. The flaw also permits an administrator on one weblog to overwrite another weblog's Velocity template, potentially affecting content rendering. Upgrading to version 6.1.6 or later mitigates this issue by scoping resource lookups to the acting weblog.
Apache Roller 6.1.5 contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue arises because the media upload feature trusts the content type supplied during upload and serves the stored file with that type, allowing a user with media-upload rights to store active content. Media uploads are disabled by default, so only installations that enable this feature are affected. The vulnerability is fixed in Apache Roller 6.1.6, which derives the stored content type from the file content and serves non-image media as downloads.
CVE-2026-82546 is a cross-site scripting (XSS) vulnerability in Apache Roller 6.1.5. It allows an unauthenticated remote attacker to store a crafted comment-author URL via the Trackback endpoint when comments and Trackbacks are enabled on a published entry. The default settings permit the malicious URL to be approved and rendered as an active link, enabling script execution in the context of the weblog's origin. Apache Roller 6.1.6 and later remove Trackback support and suppress non-HTTP(S) comment-author links to mitigate this issue. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.
Apache Roller 6.1.5 contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An anonymous remote attacker can store a comment with a javascript: URI link that bypasses HTML comment formatting and executes script when clicked by a visitor. This issue affects sites with HTML enabled in comments and using the HTMLSubset comment formatter. The vulnerability is fixed in Apache Roller 6.1.6 and later by restricting restored links to http, https, and mailto URIs.
Apache Roller 6.1.5 contains a reflected cross-site scripting (XSS) vulnerability in the optional LDAP comment authenticator. This flaw allows remote attackers to inject malicious scripts via crafted request parameters that are reflected in the authenticator's HTML form without proper escaping. The vulnerability affects only sites configured to use LdapCommentAuthenticator and requires the victim to have an active session with the authenticator form loaded. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by escaping reflected values.
A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument log_type leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Modules Anywhere (Pro) extension for Joomla versions 1.5.0 through 9.0.5. The vulnerability arises because the extension allows additional attributes on a module tag to replace arbitrary parameters of the selected module without verifying the content author. This can lead to SSRF when the replaced parameter is consumed by modules such as Joomla's core Feed module, which accepts local file and network URLs.