https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:06:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343430 EUVD-2026-343430 https://cve.radiocsirt.org/vuln/euvd-2026-343430 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21662 <p>Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.</p> <p>This issue affects FM Systems Employee: before 2025.3.1.</p> <p>Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.</p> <p>This issue affects FM Systems Employee: before 2025.3.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21662 https://cve.radiocsirt.org/vuln/ghsa-9m8h-rcg4-v896 <p>Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.</p> <p>This issue affects FM Systems Employee: before 2025.3.1.</p> <p>Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.</p> <p>This issue affects FM Systems Employee: before 2025.3.1.</p> https://cve.radiocsirt.org/vuln/ghsa-9m8h-rcg4-v896 https://cve.radiocsirt.org/vuln/icsa-26-211-02 <p>The application does not adequately restrict the types of files that can be uploaded, allowing an attacker to submit files with dangerous content types. Uploaded files may be stored in predictable locations and could be leveraged for further exploitation against the application or its users. Stored XSS occurs when the application improperly handles user input and stores malicious JavaScript code within its database. This script is then rendered and executed whenever another user accesses the compromised page. Unlike reflected XSS, persistent XSS is particularly dangerous because the payload remains active until it is manually removed from the system. HTML injection occurs when user-controlled input is embedded into web pages without proper encoding or sanitization, allowing attackers to inject arbitrary HTML markup. This vulnerability enables attackers to manipulate the Document Object Model (DOM) structure and alter the visual presentation of web content. Unlike Cross-Site Scripting (XSS), HTML injection typically involves static HTML content rather than executable JavaScript, though it can serve as a stepping stone to more severe attacks.</p> <p>The application does not adequately restrict the types of files that can be uploaded, allowing an attacker to submit files with dangerous content types. Uploaded files may be stored in predictable locations and could be leveraged for further exploitation against the application or its users. Stored XSS occurs when the application improperly handles user input and stores malicious JavaScript code within its database. This script is then rendered and executed whenever another user accesses the compromised page. Unlike reflected XSS, persistent XSS is particularly dangerous because the payload remains active until it is manually removed from the system. HTML injection occurs when user-controlled input is embedded into web pages without proper encoding or sanitization, allowing attackers to inject arbitrary HTML markup. This vulnerability enables attackers to manipulate the Document Object Model (DOM) structure and alter the visual presentation of web content. Unlike Cross-Site Scripting (XSS), HTML injection typically involves static HTML content rather than executable JavaScript, though it can serve as a stepping stone to more severe attacks.</p> https://cve.radiocsirt.org/vuln/icsa-26-211-02