A reflected cross-site scripting (XSS) vulnerability exists in the Joomla Extension php-web-design.com StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. This vulnerability allows an attacker to inject malicious scripts that are reflected off the web server, potentially leading to limited confidentiality and integrity impacts. The issue is identified as CVE-2026-105601 with a medium severity rating and a CVSS 4.0 base score of 5.3.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged attacker with local access to bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 5.5.
This vulnerability involves insufficient validation of callback URLs in the affected product, which allows attackers to manipulate these URLs with malicious payloads. Exploitation can lead to crafted links that redirect users to attacker-controlled sites, facilitating phishing attacks and potential unauthorized access or data theft.
Dell OpenManage Enterprise versions prior to 4.8.0 have a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability could be exploited remotely by an unauthenticated attacker with high attack complexity and requiring user interaction. Successful exploitation may lead to information tampering.
Dell OpenManage Enterprise versions prior to 4.8.0 have an incorrect permission assignment vulnerability. This flaw allows a low privileged attacker with local access to bypass protection mechanisms. The vulnerability does not require user interaction and impacts confidentiality but not integrity or availability.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an improper verification of cryptographic signature vulnerability. This flaw allows a high privileged attacker with local access to potentially gain filesystem access. The vulnerability is identified as CVE-2026-91905 and has a CVSS 3.1 base score of 6.4, indicating medium severity.
An improper neutralization of shell metacharacters vulnerability exists in the timezone configuration field of certain Barracuda appliance products. This flaw allows an authenticated administrator to inject operating system commands that execute with root privileges when the crafted timezone value is processed. The vulnerability has a high severity score of 8.6 and affects Barracuda appliances using common Barracuda code. No specific affected versions or patches are currently documented.
An authentication bypass vulnerability exists in Barracuda Email Security Gateway versions earlier than 9.4.0.030. This flaw allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted backup archive, leading to unauthorized modification of the appliance's global configuration.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a path traversal vulnerability that allows a high privileged attacker with adjacent network access to gain unauthorized filesystem access. This vulnerability could lead to integrity and availability impacts on the affected system.
SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.
Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.
Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them.
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.