PT-2026-98563

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leak in query perf config list When krealloc fails, free the original oa config ids before returning to avoid a memory leak. cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87...

UBUNTU-CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64347 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

MAL-2026-6243 Malicious code in atlasora-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c54cd0923afe13aadf778a5c213363c521e7a50c4b9e235bf6c7cf58a973d On npm install, the package's postinstall hook node install.js, declared in package.json harvests secrets from the installer's machine and POSTs them...

CVE-2026-33618

Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray method uses PHP's eval to parse platform settings from the database. An attacker with admin access obtainable via Advisory 1 can inject arbitrary PHP code into the settings,...

CVE-2026-33618 Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings

Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray method uses PHP's eval to parse platform settings from the database. An attacker with admin access obtainable via Advisory 1 can inject arbitrary PHP code into the settings,...

CVE-2026-33618

Chamilo LMS is affected by CVE-2026-33618. Prior to 2.0.0-RC.3, PlatformConfigurationController::decodeSettingArray() uses PHP eval() to parse settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into settings, which is executed when ...

EUVD-2026-16134

A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.html. Performing a manipulation of the argument Name results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and...

CVE-2026-4847

A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.html. Performing a manipulation of the argument Name results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and...

CVE-2026-4847

A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.html. Performing a manipulation of the argument Name results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and...

CVE-2026-4847 dameng100 muucmf list.html cross site scripting

A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.html. Performing a manipulation of the argument Name results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and...

CVE-2026-4847

The CVE-2026-4847 entry concerns dameng100 muucmf 1.9.5.20260309. A cross-site scripting flaw exists in an unknown function of /admin/config/list.html caused by manipulating the Name argument. The attack is remote and the exploit has been made public. No remediation details are provided in the do...

CVE-2026-4847 dameng100 muucmf list.html cross site scripting

A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.html. Performing a manipulation of the argument Name results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and...

MuuCmf 代码注入漏洞

MuuCmf is an open-source application development framework created by Dameng100. Version MuuCmf 1.9.5.20260309 contains a code injection vulnerability. This vulnerability stems from incorrect handling of parameters named “Name” in the file “admin/config/list.html”, which may lead to cross-site...

CVE-2024-10620: Improper Authentication

A vulnerability was found in knightliao Disconf 2.6.36. It has been classified as critical. This affects an unknown part of the file /api/config/list of the component Configuration Center. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The explo...

Rebuild SQL注入漏洞

Rebuild is a highly customizable enterprise management system. An SQL injection vulnerability exists in Rebuild 3.2.3 and earlier versions, which stems from a problem with the function queryListOfConfig in the file /admin/robot/approval/list, where manipulation of the parameter q can lead to sql...

CVE-2022-25568

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

PYSEC-2022-43141

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...

PT-2022-17371 · Motioneye · Motioneye

Name of the Vulnerable Software and Affected Versions: MotionEye versions 0.42.1 and below Description: The issue allows attackers to access sensitive information via a GET request to "/config/list". To exploit this, a regular user password must be unconfigured. Recommendations: For MotionEye...

CVE-2022-25568: Initialization of a Resource with an Insecure Default

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...