Thelia versions prior to 3.1.0 contain a stored cross-site scripting (XSS) vulnerability in the ForSomeCustomers::getSummary() function. This flaw allows unauthenticated attackers to inject malicious scripts via unescaped customer names. When administrators view coupons related to these customers, the injected scripts execute, potentially stealing CSRF tokens and enabling attackers to create administrator accounts.
DeepInfer versions up to 0.1.0 have a path traversal vulnerability in the unauthenticated /profile endpoint. This flaw allows remote attackers to create arbitrary directories via the output_dir parameter. Exploitation can lead to writing chrome trace files that exhaust disk space or inodes and can leak filesystem information through error messages.
ShowDoc versions from 2.8.14 up to but not including 3.9.6 contain a code injection vulnerability in the Mock feature. Authenticated users can exploit this flaw by storing specially crafted mockjs templates that execute shell commands with root privileges in the official Docker image. The vulnerability is fixed in version 3.9.6.
Highflame ramparts versions 0.8.1 through 0.8.10 have a vulnerability that allows attackers to bypass security scans by hiding malicious .pyc files in nested __pycache__ directories. The affected functions skip nested directories and .pyc files, enabling execution of unchecked malicious code when the skill runs.
Jpom versions 2.10.0 through 2.11.12 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to gain super-administrator access by injecting specially crafted query conditions into the JPOM-USER-TOKEN header. The vulnerability arises because the Hutool Condition parser interprets injected values like 'is not null' as operators, enabling unauthorized command execution via Jpom's script features.
Nexterm versions from 1.0.6-OPEN-PREVIEW through 1.2.2-BETA have an authorization bypass vulnerability. Authenticated users can manipulate session lifecycle endpoints to hibernate, resume, or terminate other users' remote sessions if they obtain a session ID. This affects SSH, RDP, VNC, and SFTP sessions, potentially disrupting active connections.
LearnHouse versions prior to 1.1.1 have an authorization bypass vulnerability in the assignment API. Authenticated users can exploit this flaw to access other users' grades, submissions, and instructor feedback by supplying a different user_id to the submissions grade endpoint or related read functions. This issue is fixed in version 1.1.1.
A URL associated with attacker activity linked to CVE-2021-42013 was observed multiple times in the wild on 2026-10-31. This URL was used in attacker payloads involving tool downloads or callbacks, indicating its role in ingress tool transfer (technique T1105). The attacker infrastructure was identified in India. Security teams are advised to block and monitor this URL and review proxy, web, and WAF logs for any access attempts.
The npm package @mamans2973/maman versions 1.0.0 through 1.0.3 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, necessitating immediate rotation of all secrets and keys from a different, uncompromised machine. Removal of the package alone may not eliminate all malicious software introduced by it.
A heap-based buffer overflow vulnerability exists in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2. This flaw allows an unauthenticated remote attacker to crash the index.cgi process by sending a specially crafted multipart/form-data POST request with an excessively long Content-Disposition name field.
CVE-2026-78192 is a vulnerability in WebDyne versions from 2.022 up to but not including 3.022 that allows unauthenticated remote attackers to read application source code via the default index page's source viewer. This exposure includes Perl source files and embedded credentials within __PERL__ blocks of .psp pages. The issue arises because WebDyne's wrapper scripts enable the built-in index page by default, which returns files specified by the source parameter in HTMX requests.
WebDyne versions from 2.031 up to but not including 3.022 contain a vulnerability where files with .psp anywhere in their name are executed as Perl pages due to a regular expression lacking an end anchor. This allows an attacker to upload files with names like report.psp.pdf and have them executed as Perl scripts by requesting the file, bypassing simple extension checks.
WebDyne versions from 2.014 up to but not including 3.022 contain a cross-site scripting (XSS) vulnerability. This occurs because certain form tags (textfield, password_field, filefield) reflect request parameters into their value attributes without proper escaping. The default escaping control (WEBDYNE_CGI_AUTOESCAPE) is off, and from version 2.022 the entity encoding method was replaced with a no-op, rendering escaping ineffective. An attacker can inject malicious scripts via crafted links using these tags.
CVE-2026-78189 is a path traversal vulnerability in WebDyne Perl versions from 3.007 up to but not including 3.022. It allows remote attackers to execute .psp files outside the document root by exploiting the PSGI API route fallback mechanism. The vulnerability arises because the PSGI handler does not properly sanitize path segments containing '..', enabling access to files outside the intended directory.
WebDyne versions from 2.014 up to but not including 3.022 for Perl set session cookies without the Secure, HttpOnly, and SameSite attributes. This allows browsers to send session IDs over plain HTTP and with cross-site requests, exposing them to theft by network attackers or malicious scripts. The vulnerability is fixed in version 3.022.