CVE-2026-93456: Cross-Site Request Forgery (CSRF)

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2026-87915: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

CVE-2026-54648

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54642 CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-54648 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54648 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54597

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54596

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-50022

Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An...

EUVD-2026-60601

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin...

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...

GHSA-XHFV-7758-R9HX Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...

EUVD-2026-82470

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54597

ITFlow , an IT documentation and ticketing system for managed service providers, is vulnerable to an authenticated time-based blind SQL injection via the expires GET parameter in the share_generate_link handler of agent/ajax.php. The root cause is that sanitizeInput applies string-context escapin...

EUVD-2026-82469

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54596

ITFlow , an IT documentation, ticketing, and accounting platform for managed service providers, is affected by an authenticated SQL injection in its recurring invoice endpoint (agent/post/recurring_invoice.php). The recurring_invoice_frequency parameter passes through sanitizeInput but is interpo...

CVE-2026-76154 CVE-2026-76154 CVE Record

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-82430

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...