RT's automatic link creation for URLs in HTML ticket content does
not HTML-escape the URL it places in the link. A URL crafted to
break out of the link's address can add a script that runs when the
ticket history is displayed, with no further action by the viewer.
Anyone who can add HTML content to a ticket can plant it. That
includes an unauthenticated sender of HTML email to any queue that
grants CreateTicket or ReplyToTicket to Everyone, which is routine
for a queue that accepts mail from the public. The script runs in
the session of any user who views the ticket, and can act in RT
with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.
A stored cross-site scripting (XSS) vulnerability exists in the Blocksy Companion plugin for Creative Themes, affecting versions up to 2.1.60. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and requiring user interaction to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A deserialization of untrusted data vulnerability exists in the SubWorkflow task of Google Cloud Application Integration versions prior to 2026-09-11. This flaw allows an authenticated attacker to execute arbitrary code by submitting a maliciously crafted serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required.
An improper access control vulnerability in the multi-factor authentication (MFA) feature of ManageEngine SharePoint Manager Plus (SPMP) allows a low-privileged authenticated user to bypass authorization checks. This enables reading and modifying MFA settings, enabling or disabling MFA, enumerating MFA-enrolled users, and deleting MFA-enrolled accounts. Exploitation could weaken authentication protections or cause denial of service by locking out legitimate users. The issue was fixed in build 4507; the vulnerability was demonstrated in build 4506.
Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to modify another user's AI chat history by moving messages with arbitrary content if they know the victim's chat ID. The vulnerability impacts message integrity but does not affect confidentiality or availability.
WHartTest versions 2.2.0 through 2.8.1 have a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet. Authenticated users can exploit this flaw by setting the project_pk parameter to another project's ID, enabling them to access, modify, delete, or trigger scheduled tasks and read execution logs of other projects.
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. This allows attackers to inject malicious HTML or JavaScript into attributes used for generating charts, such as users' full names, site names, or group names. The malicious content is stored and executed in the browsers of other users viewing the affected charts. The vulnerability was fixed in client application build 4508.
Tamery versions from 0.32.0 up to but not including 0.99.0 contain a broken authorization vulnerability in the cloud sync API's connectionsResources.create handler. This flaw allows authenticated users to attach resources to other users' connections by including a victim's connectionId in a batch request. The vulnerability results in unauthorized resource insertion under a victim's connection context.
Songloft versions from 2.9.0 up to but not including 2.13.6 contain a hardcoded credentials vulnerability. This flaw allows attackers on the same network segment to authenticate as an administrator using a fixed username and password (admin/admin). Exploiting this vulnerability enables unauthorized modification of library and configuration settings and installation of JavaScript plugins executed in QuickJS.
Blossom through version 1.17.1 has an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService queries only filter by folder ID, enabling attackers to supply another user's folder ID to endpoints like /folder/info, /folder/upd, /folder/open, or /folder/del. As a result, attackers can read storage paths, rename folders, toggle visibility, or delete folders belonging to other users.
CoreShop by CoreUnion versions through 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint. The flaw allows anonymous attackers to inject subqueries via the order parameter, bypassing SqlSugar's field validation. This can lead to extraction of member account and order data using boolean-based or time-based blind SQL injection techniques.
PowerDNS-Admin versions up to 2026.08.1 have an authorization bypass vulnerability. Authenticated users with User-role privileges can refresh secondary DNS zones they are not authorized to access by manipulating the 'domain' field in the JSON request body. This allows attackers with access to any one zone to trigger zone transfers (axfr-retrieve) of other users' secondary zones and potentially infer the existence of those zones based on response differences.
MuseBot versions before 2.0.0 have an authentication bypass vulnerability due to a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing a session cookie with the known default key. Successful exploitation grants full administrative access, including reading password hashes, chat records, bot configuration, and the ability to stop bots.
FilePress versions through 3.0.1 have a missing authorization vulnerability in the dzz/pichome/library component. This flaw allows authenticated users to manage folders in other libraries because the permission check only verifies membership in any library, not the specific target library. Attackers who know another library's appid or folder id can perform operations such as deleting, renaming, or reading folders they do not own.
ShowDoc versions through 3.9.5 have an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint. The endpoint only verifies edit permission for the first entry ID supplied, allowing authenticated attackers to delete parameter-description entries belonging to other users by manipulating the order of entry IDs in the request.
HuLa-Server versions through 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the PrivacyController. Authenticated users can exploit this flaw by supplying another user's uid in GET or POST requests to the /privacy endpoint, allowing them to read and overwrite that user's privacy settings without proper ownership verification.
Nging through 5.3.5 has an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the /user/autocomplete_path endpoint. Low-privileged users without file-manager permissions can supply arbitrary paths to enumerate directories readable by the Nging process and confirm the existence of specific files.
HuLa-Server versions up to 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the FriendController.friendList endpoint. Authenticated users can exploit this flaw by supplying a uid parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper authorization checks. This vulnerability exposes user contact lists to unauthorized access.
HuLa-Server versions through 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the FeedController.delFeed function. Authenticated users can exploit this flaw by sending POST requests with arbitrary feedId values to delete other users' moments, including associated media, comments, and likes. This vulnerability allows unauthorized deletion of content without proper access control checks.