EVIL0RD

MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher

SiYuan through 3.8.4 Stored XSS via notebook names

SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint

Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints

Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch