Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-7190

Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ict Innovations
Products
Ict Innovations Php-cgi Php-fpm Configuration
CVE-2025-2611

ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

CVSS 4.0 · 9.3 Critical EPSS 8.4% KEV · Not listed
Vendors
Ict Innovations
Products
Ictbroadcast