Vulnerabilities

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content.<br /> <br /> <br /> <br /> The first is in src-tauri/capabilities/default.json, which grants IPC access with "remote": { "urls": ["https://*.*"] }. That wildcard tells Tauri to accept IPC from any HTTPS origin, not just the site the application was built to wrap. The second is "withGlobalTauri": true in src-tauri/tauri.conf.json, which puts window.__TAURI__.core.invoke() in reach of ordinary page JavaScript.<br /> <br /> <br /> <br /> Tauri&amp;#39;s access control list only checks plugin commands, the ones prefixed with plugin:. Commands the application registers itself through generate_handler!, known as app commands, are never checked against the ACL. So once an origin holds IPC access, it can call every app command with nothing else standing in the way. Pake registers download_file as an app command, and it does not appear in the permissions list because it does not need to.<br /> <br /> <br /> <br /> The practical effect is that any script running on any HTTPS page inside a Pake application can invoke the application&amp;#39;s native commands. That includes third-party script the wrapped site loads on its own, such as analytics, advertising, or a compromised CDN. Anyone distributing their own Pake application gets the same access without asking for it. Chained with the path traversal in download_file that is tracked separately as CVE-2026-82635, this reaches arbitrary file write and persistent code execution.

Tauri&amp;#39;s Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.

When a Tauri application uses the dialog plugin&amp;#39;s file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource<br /> <br /> <br /> <br /> This issue affects Apache Sling Security Bundle: before 1.3.12.<br /> <br /> <br /> <br /> Users are recommended to upgrade to version 1.3.12, which fixes the issue.

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.<br /> <br /> <br /> <br /> This issue affects Apache Sling Security Bundle: before 1.3.2.<br /> <br /> <br /> <br /> Users are recommended to upgrade to version 1.3.2, which fixes the issue.

Improper restriction of recursive entity references in DTDs (&amp;#39;XML entity expansion&amp;#39;) vulnerability in Apache Sling XSS.<br /> <br /> <br /> <br /> This issue affects Apache Sling XSS: before 2.4.12.<br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in Apache Sling XSS.<br /> <br /> <br /> <br /> This issue affects Apache Sling XSS: before 2.4.12.<br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in Apache Sling XSS.<br /> <br /> <br /> <br /> This issue affects Apache Sling XSS: before 2.4.12.<br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick&amp;#39;s Context2D.path / PathSvg.path.