paicoding versions 1.0.0 through 1.0.3 contain a stored cross-site scripting (XSS) vulnerability. The SeoInjectService component embeds user profile text into an inline JSON-LD script element without proper escaping. Authenticated attackers can inject a closing script tag and arbitrary HTML into their profile, enabling script execution in the context of visitors viewing that profile page. This can lead to theft of non-HttpOnly f-session cookies.
CVE-2026-129142 is a stored cross-site scripting (XSS) vulnerability in the paicoding product by itwanger. The flaw occurs in the payment notifications feature, where the payer's display name is inserted without proper escaping and rendered unsafely in the notification HTML. Authenticated attackers can exploit this by setting a malicious display name and initiating a pending payment on a paid article, causing script execution in the author's browser when viewing notifications.
paicoding version 1.0.3 has a missing authorization vulnerability in its ArticleRestController article detail endpoint. This flaw allows unauthenticated attackers to access restricted articles, including paid, login-only, member-only, and draft content, by enumerating article IDs via a GET request.
paicoding version 1.0.3 has a payment bypass vulnerability that allows authenticated attackers to unlock paid articles without completing payment. The flaw arises from a small space of random payment confirmation codes, enabling attackers to guess valid codes by enumerating approximately 2000 counter values and submitting matching verification codes to an unauthenticated callback endpoint to mark payments as completed.
SurveyKing version 1.13.2 has a missing authorization vulnerability in its result lookup feature. This flaw allows unauthenticated attackers with access to a public survey link to bypass password checks and retrieve complete survey responses, including hidden fields, by exploiting a wildcard injection in the MyBatis LIKE condition.
SurveyKing versions 1.12.0 through 1.13.2 have an authentication bypass vulnerability in the AnswerServiceImpl.saveAnswer function. This flaw allows unauthenticated attackers to submit survey responses without passing login or survey password checks. Attackers can also impersonate other users by setting the createBy field in the request, potentially corrupting survey data.
SurveyKing versions 1.12.0 through 1.13.2 have an authorization bypass vulnerability in the linked survey feature. This flaw allows authenticated users to manipulate the linked survey ID to access and modify survey responses belonging to other users. The vulnerability arises because the system does not verify that the linked survey ID belongs to the caller's own project.
SurveyKing versions 1.13.0 through 1.13.2 have a stored cross-site scripting (XSS) vulnerability. This occurs because the server accepts survey snapshots supplied by respondents, and the frontend renders snapshot titles using innerHTML without proper neutralization. An anonymous respondent can submit a crafted snapshot containing malicious event handlers, such as img onerror, which execute in an administrator's browser when viewing the response.
DjangoBlog versions 2.0.0.0 through 2.1.0.0 are affected by a stored cross-site scripting (XSS) vulnerability. The issue arises because the comment sanitizer improperly allows event-handler attributes such as autofocus and onfocus on certain HTML tags. Authenticated users can exploit this by posting specially crafted comments that execute scripts automatically when viewed by others, including administrators.
CVE-2026-129156 is a stored cross-site scripting (XSS) vulnerability in DjangoBlog versions between commits d186b1c and 6134ed6. Authenticated OAuth users can exploit this flaw by setting their OAuth display name to a malicious script payload that closes a single-quoted attribute in comment reactions. When such a user reacts to a comment, the injected script executes in the browsers of visitors viewing the article.
ragent versions 1.0.0 through 1.1.0 have a missing authorization vulnerability in the RagTraceController. This flaw allows any authenticated user to access and view all users' RAG traces, including sensitive details such as usernames, user IDs, conversation IDs, questions, and execution details for each node. The vulnerability enables unauthorized data exposure by paging through specific endpoints.
ragent version 1.1.0 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files with embedded scripts via the knowledge base document upload endpoint. When other users view these SVG files served inline, the malicious scripts execute in the context of the application, potentially leading to account takeover.
free-fs versions 2.0.1 through 2.3.1 have an SQL injection vulnerability in the FileShareServiceImpl.getPages method. This flaw allows authenticated users to inject malicious SQL via the orderBy parameter in the /apis/share/pages endpoint, which is used directly in an ORDER BY clause without proper validation. Exploitation can lead to unauthorized reading of arbitrary database contents, such as share codes.
Dromara free-fs versions 2.0.1 through 2.3.1 have a vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes. The flaw exists in the PUT /apis/user/forget-password endpoint, where attackers can request a reset code for a known email and submit unlimited guesses during the code's 300-second validity period. Successful exploitation enables account takeover by setting a chosen password.
Dromara free-fs versions 2.0.1 through 2.3.1 have a missing authentication vulnerability in the FileStreamController.preview function. This flaw allows unauthenticated attackers to download stored files by requesting the preview endpoint with a valid file ID. Attackers can obtain file IDs from share listings or preview links, enabling unauthorized access to any user's or workspace's files.
Dromara free-fs versions 2.0.1 through 2.3.1 have a stored cross-site scripting (XSS) vulnerability. Registered users can upload HTML files that are served inline as text/html, enabling execution of malicious scripts in the context of the application. Attackers can exploit this by sending victims a crafted preview link to execute scripts that interact with the application's API endpoints, potentially exposing victim files and account data.
Dromara free-fs versions 2.0.1 through 2.3.1 have an authorization bypass vulnerability due to client-side enforcement of share codes. Attackers who know a share ID can access and download files from code-protected shares without needing the share code, even for preview-only shares.
CVE-2026-129165 is a critical vulnerability in AmidaWare Tactical RMM versions 0.17.0 through 1.6.1. It allows users with report management permissions to perform arbitrary file reads via the /reporting/templates/preview/ endpoint. This occurs because WeasyPrint resolves file:// links in user-supplied template markdown, embedding local files into generated PDFs. Exploitation can expose the Django SECRET_KEY, which is reused as the NATS password, enabling attackers to publish runscript commands to all managed agents.
Keep versions 0.34.10 through 0.55.0 contain a blind SQL injection vulnerability in the CEL-to-SQL converter. Authenticated users with read:alert permission can exploit this flaw by submitting crafted CEL expressions to specific endpoints, allowing them to extract other tenants' alerts and password hashes via a boolean oracle technique.
Seafile SeaDoc versions 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contain an absolute path traversal vulnerability. This flaw allows unauthenticated attackers with a public share token to execute arbitrary code by supplying an absolute filename to a specific API endpoint, leading to malicious code importation.