Fluid Attacks — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by Fluid Attacks (fluid_attacks). https://vulnogram.org/seaview/icons/fluid_attacks.png Fluid Attacks — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT CVE-2026-103038 · 8.6 HIGH — PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host https://vulnogram.org/CVE-2026-103038 https://vulnogram.org/CVE-2026-103038 PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and… High Mon, 19 Oct 2026 16:13:35 GMT CVE-2026-101947 · 8.4 HIGH — ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export https://vulnogram.org/CVE-2026-101947 https://vulnogram.org/CVE-2026-101947 ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not… High Sat, 10 Oct 2026 03:06:42 GMT CVE-2026-91107 · 9.3 CRITICAL — openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR) https://vulnogram.org/CVE-2026-91107 https://vulnogram.org/CVE-2026-91107 openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password. Critical Mon, 05 Oct 2026 21:29:29 GMT CVE-2026-102626 · 7.2 HIGH — LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute https://vulnogram.org/CVE-2026-102626 https://vulnogram.org/CVE-2026-102626 An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey i… High Fri, 02 Oct 2026 17:16:14 GMT CVE-2026-97685 · 7.1 HIGH — LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations https://vulnogram.org/CVE-2026-97685 https://vulnogram.org/CVE-2026-97685 An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint… High Tue, 29 Sep 2026 02:20:43 GMT CVE-2026-85082 · 8.5 HIGH — Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames https://vulnogram.org/CVE-2026-85082 https://vulnogram.org/CVE-2026-85082 Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. High Thu, 24 Sep 2026 23:48:37 GMT CVE-2026-84283 · 6.8 MEDIUM — FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate https://vulnogram.org/CVE-2026-84283 https://vulnogram.org/CVE-2026-84283 Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open th… Medium Thu, 24 Sep 2026 23:41:34 GMT CVE-2026-92730 · 7.4 HIGH 🌩️ — LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name https://vulnogram.org/CVE-2026-92730 https://vulnogram.org/CVE-2026-92730 LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page. High Network Exploitable Wed, 23 Sep 2026 18:02:02 GMT CVE-2026-91775 · 7.4 HIGH 🌩️ — LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings https://vulnogram.org/CVE-2026-91775 https://vulnogram.org/CVE-2026-91775 LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface. High Network Exploitable Wed, 23 Sep 2026 17:13:46 GMT CVE-2026-93769 · 7.2 HIGH — HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover https://vulnogram.org/CVE-2026-93769 https://vulnogram.org/CVE-2026-93769 HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field… High Wed, 23 Sep 2026 15:49:51 GMT CVE-2026-77875 · 6.8 MEDIUM — Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage https://vulnogram.org/CVE-2026-77875 https://vulnogram.org/CVE-2026-77875 The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or a… Medium Fri, 18 Sep 2026 23:29:28 GMT CVE-2026-79954 · 8.7 HIGH 🌩️ — NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID https://vulnogram.org/CVE-2026-79954 https://vulnogram.org/CVE-2026-79954 NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not… High Network Exploitable Fri, 18 Sep 2026 00:26:28 GMT CVE-2026-77884 · 7.1 HIGH — Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure https://vulnogram.org/CVE-2026-77884 https://vulnogram.org/CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage. High Mon, 14 Sep 2026 18:02:16 GMT CVE-2026-81301 · 8.5 HIGH — Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access https://vulnogram.org/CVE-2026-81301 https://vulnogram.org/CVE-2026-81301 Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to… High Mon, 14 Sep 2026 15:51:38 GMT CVE-2026-19754 · 8.6 HIGH — Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction https://vulnogram.org/CVE-2026-19754 https://vulnogram.org/CVE-2026-19754 Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a… High Wed, 02 Sep 2026 03:29:38 GMT CVE-2026-65931 · 5.1 MEDIUM — LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint https://vulnogram.org/CVE-2026-65931 https://vulnogram.org/CVE-2026-65931 LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admi… Medium Thu, 27 Aug 2026 17:50:47 GMT CVE-2026-63360 · 7.4 HIGH 🌩️ — LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint https://vulnogram.org/CVE-2026-63360 https://vulnogram.org/CVE-2026-63360 LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input att… High Network Exploitable Wed, 26 Aug 2026 21:47:49 GMT CVE-2026-16809 · 7.2 HIGH — LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering https://vulnogram.org/CVE-2026-16809 https://vulnogram.org/CVE-2026-16809 LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota m… High Wed, 26 Aug 2026 21:39:12 GMT CVE-2026-65930 · 4.8 MEDIUM — LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields https://vulnogram.org/CVE-2026-65930 https://vulnogram.org/CVE-2026-65930 LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5. Medium Wed, 26 Aug 2026 21:24:52 GMT CVE-2026-15973 · 8.4 HIGH — LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries https://vulnogram.org/CVE-2026-15973 https://vulnogram.org/CVE-2026-15973 LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-… High Wed, 26 Aug 2026 20:42:44 GMT CVE-2026-19755 · 6.9 MEDIUM — NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper https://vulnogram.org/CVE-2026-19755 https://vulnogram.org/CVE-2026-19755 NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1. Medium Thu, 20 Aug 2026 20:26:12 GMT CVE-2026-19198 · 8.7 HIGH — Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch https://vulnogram.org/CVE-2026-19198 https://vulnogram.org/CVE-2026-19198 Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21. High Wed, 19 Aug 2026 18:58:01 GMT CVE-2026-18430 · 7.2 HIGH — HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason https://vulnogram.org/CVE-2026-18430 https://vulnogram.org/CVE-2026-18430 HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion rea… High Wed, 19 Aug 2026 15:52:49 GMT CVE-2026-18756 · 7.2 HIGH — HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering https://vulnogram.org/CVE-2026-18756 https://vulnogram.org/CVE-2026-18756 HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership… High Wed, 19 Aug 2026 14:46:25 GMT CVE-2026-18526 · 7.4 HIGH — HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation https://vulnogram.org/CVE-2026-18526 https://vulnogram.org/CVE-2026-18526 HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow. High Wed, 19 Aug 2026 14:17:00 GMT CVE-2026-18403 · 6 MEDIUM — LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB https://vulnogram.org/CVE-2026-18403 https://vulnogram.org/CVE-2026-18403 LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list. Medium Fri, 14 Aug 2026 18:33:31 GMT CVE-2026-63361 · 8.5 HIGH 🌩️ — LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup https://vulnogram.org/CVE-2026-63361 https://vulnogram.org/CVE-2026-63361 LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context… High Network Exploitable Fri, 14 Aug 2026 17:04:07 GMT CVE-2026-10716 · 7.5 HIGH — Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation https://vulnogram.org/CVE-2026-10716 https://vulnogram.org/CVE-2026-10716 Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts wit… High Wed, 05 Aug 2026 16:50:49 GMT CVE-2026-13227 · 7.1 HIGH — ERPNext v16.25.0 - Improper authorization in Prospect opportunities API https://vulnogram.org/CVE-2026-13227 https://vulnogram.org/CVE-2026-13227 An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. This issue affects ERPNext: before 15.… High Tue, 04 Aug 2026 20:53:53 GMT CVE-2026-13229 · 7.1 HIGH — Zammad 7.0.1 - Improper authorization in ticket article attachment cloning https://vulnogram.org/CVE-2026-13229 https://vulnogram.org/CVE-2026-13229 Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint. High Tue, 04 Aug 2026 18:12:04 GMT CVE-2026-14871 · 7.1 HIGH — osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure https://vulnogram.org/CVE-2026-14871 https://vulnogram.org/CVE-2026-14871 osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem. High Fri, 17 Jul 2026 14:55:32 GMT CVE-2026-11944 · 5.3 MEDIUM — openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download https://vulnogram.org/CVE-2026-11944 https://vulnogram.org/CVE-2026-11944 openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequ… Medium Tue, 14 Jul 2026 15:23:47 GMT CVE-2026-11779 · 5.3 MEDIUM — PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access https://vulnogram.org/CVE-2026-11779 https://vulnogram.org/CVE-2026-11779 An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation. Medium Fri, 26 Jun 2026 16:09:43 GMT CVE-2026-50712 · 4.8 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering https://vulnogram.org/CVE-2026-50712 https://vulnogram.org/CVE-2026-50712 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.ui.Tree component Medium Wed, 24 Jun 2026 15:26:54 GMT CVE-2026-50711 · 4.6 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering https://vulnogram.org/CVE-2026-50711 https://vulnogram.org/CVE-2026-50711 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component. Medium Wed, 24 Jun 2026 15:18:43 GMT CVE-2026-50710 · 4.6 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config https://vulnogram.org/CVE-2026-50710 https://vulnogram.org/CVE-2026-50710 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component. Medium Wed, 24 Jun 2026 15:08:41 GMT CVE-2026-50709 · 4.8 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering https://vulnogram.org/CVE-2026-50709 https://vulnogram.org/CVE-2026-50709 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Notifications > Events panel. Medium Wed, 24 Jun 2026 15:04:39 GMT CVE-2026-50708 · 4.8 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering https://vulnogram.org/CVE-2026-50708 https://vulnogram.org/CVE-2026-50708 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component. Medium Wed, 24 Jun 2026 14:58:51 GMT CVE-2026-50705 · 4.6 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering https://vulnogram.org/CVE-2026-50705 https://vulnogram.org/CVE-2026-50705 A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer. Medium Wed, 24 Jun 2026 14:51:29 GMT CVE-2026-50704 · 4.6 MEDIUM — Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering https://vulnogram.org/CVE-2026-50704 https://vulnogram.org/CVE-2026-50704 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer. Medium Wed, 24 Jun 2026 14:46:38 GMT CVE-2026-50703 · 4.8 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering https://vulnogram.org/CVE-2026-50703 https://vulnogram.org/CVE-2026-50703 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer. Medium Wed, 24 Jun 2026 14:42:09 GMT CVE-2026-50701 · 5.1 MEDIUM 🌩️ — Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering https://vulnogram.org/CVE-2026-50701 https://vulnogram.org/CVE-2026-50701 A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component. Medium Network Exploitable Wed, 24 Jun 2026 14:33:09 GMT CVE-2026-50700 · 4.6 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering https://vulnogram.org/CVE-2026-50700 https://vulnogram.org/CVE-2026-50700 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function. Medium Wed, 24 Jun 2026 14:27:06 GMT CVE-2026-50699 · 4.6 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering https://vulnogram.org/CVE-2026-50699 https://vulnogram.org/CVE-2026-50699 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in reference_document using a whitelisted write path and trigger s… Medium Wed, 24 Jun 2026 14:20:31 GMT CVE-2026-50698 · 4.6 MEDIUM — Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering https://vulnogram.org/CVE-2026-50698 https://vulnogram.org/CVE-2026-50698 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component. Medium Wed, 24 Jun 2026 14:17:03 GMT CVE-2026-11994 · 4.8 MEDIUM — Akaunting 3.1.21 - Authenticated stored XSS in report description rendering https://vulnogram.org/CVE-2026-11994 https://vulnogram.org/CVE-2026-11994 Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report. Medium Mon, 22 Jun 2026 15:37:58 GMT CVE-2026-11943 · 4.8 MEDIUM — Akaunting 3.1.21 - Authenticated stored XSS in document timeline https://vulnogram.org/CVE-2026-11943 https://vulnogram.org/CVE-2026-11943 Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name. Medium Mon, 22 Jun 2026 15:30:36 GMT CVE-2026-11942 · 4.8 MEDIUM — Akaunting 3.1.21 - Stored XSS in delete confirmation modal https://vulnogram.org/CVE-2026-11942 https://vulnogram.org/CVE-2026-11942 Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name. Medium Mon, 22 Jun 2026 15:18:29 GMT CVE-2026-11982 · 5.1 MEDIUM — Stored XSS via missing XSS safety check in Admin2 Pages API partial validation https://vulnogram.org/CVE-2026-11982 https://vulnogram.org/CVE-2026-11982 Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow. Medium Thu, 18 Jun 2026 16:22:19 GMT CVE-2026-10850 · 6.9 MEDIUM — Plane 1.3.1 - Stored XSS in intake issue description_html https://vulnogram.org/CVE-2026-10850 https://vulnogram.org/CVE-2026-10850 Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint. Medium Wed, 17 Jun 2026 14:39:51 GMT