The Advanced Custom Fields: Extended (ACFE) plugin for WordPress up to version 0.9.2.6 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete arbitrary media library attachments by submitting a crafted form with a numeric attachment ID, bypassing ownership and capability checks. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action that includes a deletable attachment field bound to user input.
An unauthenticated stored cross-site scripting (XSS) vulnerability exists in the DJ-HelpfulArticles Joomla extension versions prior to 1.3.0. The vulnerability arises because the 'was this article helpful' voting widget accepts a client-supplied IP field via AJAX handlers without proper validation or output escaping. This field is stored and later rendered in the administrator backend without HTML escaping, allowing injection of malicious scripts. The lack of CSRF protection, rate limiting, and reliance on an attacker-controlled field for vote de-duplication exacerbates the risk.
The darylldoyle svg-sanitizer library versions before 1.0.0 contain vulnerabilities related to CSS injection and remote reference bypass. These flaws allow attackers to embed external resources by uploading crafted SVG files. Exploitation can involve unsanitized style content, unquoted url() values, or image href attributes, potentially leading to data exfiltration, user tracking, or visitor IP disclosure.
A reflected cross-site scripting (XSS) vulnerability exists in Kulga News Software versions from 26.7.4 up to but not including 26.10.0. This flaw is due to improper neutralization of input during web page generation, which can lead to the execution of malicious scripts in a user's browser. The vulnerability has a medium severity rating with a CVSS score of 6.1.
The svg-sanitizer library versions from 0.11.0 up to but not including 1.1.0 contain a vulnerability where submitting well-formed XML documents without a top-level svg root element causes an uncaught exception. Specifically, supplying documents with a non-svg root or nested svg element triggers a LogicException in the Sanitizer::sanitize() function, leading to crashes or bypassing upload rejection.
A denial of service vulnerability exists in svg-sanitizer versions from 0.5.3 up to but not including 1.1.0. The flaw occurs in the Sanitizer::sanitize() function, which repeatedly rescans the entire input while stripping PHP tags. This behavior allows unauthenticated attackers to craft SVG files containing many overlapping PHP tag openers and closers, causing excessive CPU usage and service disruption.
REDAXO versions prior to 5.21.0 have a reflected cross-site scripting (XSS) vulnerability in the backend packages API. The flaw arises because a function parameter is concatenated into an error message without proper HTML escaping. An attacker can exploit this by tricking an authenticated backend user into clicking a crafted link containing a valid CSRF token, leading to execution of malicious JavaScript that can perform same-origin actions or read DOM data.
REDAXO versions prior to 5.21.3 have a reflected cross-site scripting (XSS) vulnerability in the backend media pool detail page. The vulnerability arises because the opener_link parameter is rendered without proper HTML escaping. An unauthenticated attacker can trick logged-in backend users with media permissions into clicking a crafted link, allowing script injection. This script can read the victim's CSRF token and perform actions with their permissions, including potentially executing code via template or module edits if the victim has administrator privileges.
REDAXO versions before 5.21.0 have a reflected cross-site scripting (XSS) vulnerability in the metainfo_default_fields_create API. Authenticated attackers can inject malicious scripts via the type parameter, which are rendered unescaped in the backend session. This allows script execution in the victim's backend context.
REDAXO versions before 5.21.3 have a cross-site request forgery (CSRF) vulnerability in the backend user administration page. The CSRF token check is only enforced when the save parameter is set, but the update path triggered by FUNC_UPDATE bypasses this check. This allows attackers to trick logged-in backend users with the users[] permission into performing unauthorized actions such as granting administrator rights, deactivating accounts, or locking out the sole administrator via crafted GET requests.
REDAXO versions before 5.21.3 have a cross-site request forgery (CSRF) vulnerability in the structure/history plugin. This flaw allows attackers to trick logged-in backend users into sending unvalidated GET requests that can delete all article snapshots or revert articles to previous states. The vulnerability can cause loss of content history or unintended content rollback.
A vulnerability in certain versions of Octopus Server allows users with the System Manager role to escalate their privileges to full system Administrator. This elevation of privilege could enable unauthorized administrative control over the system.
REDAXO core versions from 5.3.0 up to but not including 5.21.4 contain an authentication bypass vulnerability in the structure/history plugin. This flaw allows unauthenticated attackers to forge temporary login tokens by forcing the session-tied secret into a predictable state. Exploitation can lead to unauthorized backend access, including admin-level privileges, and code execution outside of live mode.
REDAXO versions before 5.21.4 have a broken access control vulnerability that allows authenticated editors to modify slices in categories they are not authorized to access. By pairing a permitted article with a foreign slice ID, attackers can abuse content editing, deletion, and slice status or movement APIs to delete, toggle, move, or overwrite slices belonging to other editors.
REDAXO versions before 5.21.4 have a missing authorization vulnerability in the media pool bulk move feature. The vulnerability arises because the system only checks permissions on the target category and ignores the source category. Authenticated backend users with permission on one media category can move files from restricted categories into their permitted category and replace their contents silently across the site.
In certain versions of Octopus Server, creating a user invitation causes the invitation code to be logged in the audit event log. If the invitation is linked to a space, users with appropriate permissions in that space could read the invitation code from the audit log. An attacker who redeems the unclaimed invitation might escalate privileges depending on the permissions assigned to the invited user. This vulnerability has a high severity rating with a CVSS score of 7.7.
REDAXO versions from 5.18.0 up to but not including 5.21.4 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the rex_media_service component moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can exploit a race condition or exhaust memory limits to leave malicious script-laden SVG files accessible, leading to script execution in victims' backend sessions.
JetBrains Junie CLI versions prior to 26.8.17 contain a vulnerability that allows command execution due to incomplete validation of allowlisted commands. This flaw could enable an attacker with limited privileges to execute arbitrary commands. The issue has been assigned CVE-2026-117530 and carries a CVSS score of 6.7, indicating a medium severity level.
REDAXO versions before 5.21.4 have a stored cross-site scripting (XSS) vulnerability. This flaw allows content editors to inject malicious HTML by submitting crafted input values that are stored and later rendered without proper escaping in media-related widgets. Exploitation can lead to script execution in administrators' backend sessions, potentially hijacking their accounts.
REDAXO versions before 5.21.5 have a cross-site request forgery (CSRF) vulnerability in the backend. The vulnerability arises because the safemode GET parameter in index.php is processed without validating a CSRF token. An attacker can exploit this by tricking a logged-in administrator into clicking a crafted link, which can disable global safe mode or enable session safe mode, potentially impacting backend addon functionality.