Vulnerabilities

TI-2026-21096 CVE-2026-26102 · GHSA-wqpx-frj2-7xmj

Incorrect permission assignment in Owl opds

LOW 38

Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00123 Published 2026-02-20 No fix listed CWE-732

TI-2026-21095 CVE-2026-26101 · GHSA-rr5p-xfmq-r2vx

Incorrect permission assignment in Owl opds

LOW 38

Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00123 Published 2026-02-20 No fix listed CWE-732

TI-2026-21094 CVE-2026-26100 · GHSA-988g-r4v6-j68v

Incorrect permission assignment in Owl opds

LOW 31

Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00103 Published 2026-02-20 No fix listed CWE-732

TI-2026-21093 CVE-2026-26099 · GHSA-cjp5-2c5h-3735

Uncontrolled search path in Owl opds

LOW 37

Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.00126 Published 2026-02-20 No fix listed CWE-427

TI-2026-21092 CVE-2026-26098 · GHSA-38gw-g59j-rr5c

Uncontrolled search path in Owl opds

LOW 37

Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.00126 Published 2026-02-20 No fix listed CWE-427

TI-2026-21091 CVE-2026-26097 · GHSA-gcfc-fjf7-2pj9

Uncontrolled search path in Owl opds

LOW 37

Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.00126 Published 2026-02-20 No fix listed CWE-427

TI-2026-21090 CVE-2026-26096 · GHSA-pm2j-978g-6g85

Incorrect permission assignment in Owl opds

LOW 38

Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00111 Published 2026-02-20 No fix listed CWE-732

TI-2026-21089 CVE-2026-26095 · GHSA-p2m5-3j38-g6mj

Incorrect permission assignment in Owl opds

LOW 38

Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00111 Published 2026-02-20 No fix listed CWE-732

TI-2026-21088 CVE-2026-26093 · GHSA-42vx-f9wx-wg3r

Command injection in Owl opds

MEDIUM 42

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01283 Published 2026-02-20 No fix listed CWE-77

TI-2026-01973 CVE-2026-2333 · GHSA-q2ch-643m-222m

Command injection in Owl opds

MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01191 Published 2026-02-20 No fix listed CWE-77

TI-2013-04173 CVE-2013-4754 · GHSA-p5xf-7mcq-mm4c

Multiple cross-site scripting (XSS) vulnerabilities in Owl Intranet Knowledgebase 1.10…

LOW 18

Multiple cross-site scripting (XSS) vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Search field to browse.php or (2) the Title field…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.00782 Published 2014-12-26 No fix listed CWE-79

TI-2008-03220 CVE-2008-3359 · GHSA-qf22-cr2w-g2fr

SQL injection vulnerability in register.php in Steve Bourgeois and Chris Vincent Owl…

LOW 35

SQL injection vulnerability in register.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01049 Published 2008-07-29 No fix listed CWE-89

TI-2008-02964 CVE-2008-3100 · GHSA-h97f-mg55-8293

Cross-site scripting (XSS) vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris…

LOW 24

Cross-site scripting (XSS) vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02281 Published 2008-07-29 No fix listed CWE-79

TI-2006-01116 CVE-2006-1149 · GHSA-qfg4-pq8r-m2f9

PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82…

MEDIUM 45

PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, whic…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.09993 Published 2006-03-10 No fix listed

TI-2005-00230 CVE-2005-0265 · GHSA-5c56-hjgm-2mxx

Multiple SQL injection vulnerabilities in browse.php in OWL 0.7 and 0.8 allow remote…

LOW 36

Multiple SQL injection vulnerabilities in browse.php in OWL 0.7 and 0.8 allow remote attackers to execute arbitrary SQL commands via the (1) parent or (2) sortposted parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01345 Published 2005-02-10 No fix listed

TI-2005-00229 CVE-2005-0264 · GHSA-9572-vgq7-c3wr

Multiple cross-site scripting (XSS) vulnerabilities in browse.php in OWL 0.7 and 0.8…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in browse.php in OWL 0.7 and 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) expand or (2) order parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01255 Published 2005-02-10 No fix listed

TI-2003-00321 CVE-2003-0341 · GHSA-j9v6-gw7c-pgcv

Cross-site scripting (XSS) vulnerability in Owl Intranet Engine 0.71 and earlier allows…

LOW 33

Cross-site scripting (XSS) vulnerability in Owl Intranet Engine 0.71 and earlier allows remote attackers to insert arbitrary script via the Search field.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01703 Published 2003-05-23 No fix listed

Vulnerabilities

Filters