ragent version 1.1.0 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files with embedded scripts via the knowledge base document upload endpoint. When other users view these SVG files served inline, the malicious scripts execute in the context of the application, potentially leading to account takeover.
free-fs versions 2.0.1 through 2.3.1 have an SQL injection vulnerability in the FileShareServiceImpl.getPages method. This flaw allows authenticated users to inject malicious SQL via the orderBy parameter in the /apis/share/pages endpoint, which is used directly in an ORDER BY clause without proper validation. Exploitation can lead to unauthorized reading of arbitrary database contents, such as share codes.
Dromara free-fs versions 2.0.1 through 2.3.1 have a vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes. The flaw exists in the PUT /apis/user/forget-password endpoint, where attackers can request a reset code for a known email and submit unlimited guesses during the code's 300-second validity period. Successful exploitation enables account takeover by setting a chosen password.
Dromara free-fs versions 2.0.1 through 2.3.1 have a missing authentication vulnerability in the FileStreamController.preview function. This flaw allows unauthenticated attackers to download stored files by requesting the preview endpoint with a valid file ID. Attackers can obtain file IDs from share listings or preview links, enabling unauthorized access to any user's or workspace's files.
Dromara free-fs versions 2.0.1 through 2.3.1 have a stored cross-site scripting (XSS) vulnerability. Registered users can upload HTML files that are served inline as text/html, enabling execution of malicious scripts in the context of the application. Attackers can exploit this by sending victims a crafted preview link to execute scripts that interact with the application's API endpoints, potentially exposing victim files and account data.
Dromara free-fs versions 2.0.1 through 2.3.1 have an authorization bypass vulnerability due to client-side enforcement of share codes. Attackers who know a share ID can access and download files from code-protected shares without needing the share code, even for preview-only shares.
CVE-2026-129165 is a critical vulnerability in AmidaWare Tactical RMM versions 0.17.0 through 1.6.1. It allows users with report management permissions to perform arbitrary file reads via the /reporting/templates/preview/ endpoint. This occurs because WeasyPrint resolves file:// links in user-supplied template markdown, embedding local files into generated PDFs. Exploitation can expose the Django SECRET_KEY, which is reused as the NATS password, enabling attackers to publish runscript commands to all managed agents.
Keep versions 0.34.10 through 0.55.0 contain a blind SQL injection vulnerability in the CEL-to-SQL converter. Authenticated users with read:alert permission can exploit this flaw by submitting crafted CEL expressions to specific endpoints, allowing them to extract other tenants' alerts and password hashes via a boolean oracle technique.
Seafile SeaDoc versions 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contain an absolute path traversal vulnerability. This flaw allows unauthenticated attackers with a public share token to execute arbitrary code by supplying an absolute filename to a specific API endpoint, leading to malicious code importation.
PMail versions 2.9.1 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability in the /attachments/{id}/{cid} endpoint. This endpoint returns email attachments with the sender-supplied Content-Type after rewriting cid: references into attachment links. An unauthenticated SMTP sender can exploit this by sending a text/html attachment and a page-covering cid link, causing the recipient's webmail session to execute malicious script, potentially allowing password changes including for administrators.
Jinnrry PMail versions 2.5.0 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts via the /api/email/send endpoint by sending unsanitized HTML. These scripts can execute when administrators view the crafted messages, potentially allowing attackers to perform privileged API actions such as changing passwords and taking over accounts.
FileCodeBox versions 2.2.1 through 2.8.4 have a stored cross-site scripting (XSS) vulnerability in the renderMarkdownPreview function. This flaw occurs because unsanitized text is returned when the marked parser throws an error. Unauthenticated attackers can exploit this by sharing text containing many nested blockquote markers followed by malicious HTML, enabling script execution that can steal the admin token from localStorage.
NginxPulse versions from 1.5.0 up to but not including 1.6.26 contain an unauthenticated SQL injection vulnerability in the /api/stats/:type endpoint via the id and locationType parameters. This flaw allows remote attackers to manipulate SQL commands, potentially reading database contents and accessing or modifying server files through PostgreSQL superuser functions. The vulnerability is critical with a CVSS 4.0 score of 9.3. A fix is available in version 1.6.26.
EdgeEver versions 1.9.0 up to but not including 2.13.0 contain a stored cross-site scripting (XSS) vulnerability in the backup restore endpoint. This flaw allows authenticated users to share a note with a crafted public blob link that causes a victim's browser to execute malicious script. The script can mint a non-expiring API token granting read and write access to the victim's notes. The vulnerability is fixed in version 2.13.0.
Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspace file above it, or a parent pnpm or Deno settings file that does not declare packages or a workspace, including when the project is inside a Git repository. When the development server is reachable from an untrusted network, Vite permits /_nuxt/@fs/ requests beneath that widened directory, allowing unauthenticated clients to read files such as credentials and SSH keys. The issue affects the development server only; production builds and projects whose parent directories contain no qualifying files are unaffected. This issue is fixed in version 4.6.4.
A cross-site scripting (XSS) vulnerability exists in rails-html-sanitizer versions prior to 1.7.2 due to unsafe reuse of a permit scrubber in multithreaded environments. Concurrent sanitization calls with different allowlists can cause one call to use another's permissive allowlist, potentially allowing script elements or event-handler attributes to bypass sanitization. This issue is fixed in version 1.7.2.
A vulnerability in rails-html-sanitizer versions 1.0.3 through 1.7.1 allows an attacker to cause uncontrolled resource consumption (CPU usage) by supplying crafted HTML with SVG reference elements and certain href attributes. This leads to quadratic CPU consumption due to inefficient regular expression matching in affected Ruby interpreters. The issue is fixed in version 1.7.2.
CVE-2026-123965 is a critical prompt injection vulnerability in all versions of Jet Admin Cloud Platform. It allows a remote attacker with a free account to access sensitive .env configuration files and exfiltrate critical credentials. The vulnerability was mitigated around October 29, 2026, by implementing a sandbox component.
Catalis WebPro 5.0 contains a SQL Injection vulnerability that allows remote unauthenticated attackers to execute arbitrary SQL queries on the underlying MSSQL database. This can lead to unauthorized access and exfiltration of sensitive property and taxpayer information. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.