1265 matches found
CVE-2021-40978
CVE-2021-40978 mkdocs 組み込み dev-server のディレクトリトラバーサル Mkdocs 1.2.2 では、ポート 8000 で応答する組み込み dev-server を介したディレクトリトラバーサルが可能です。 以下に、正常に悪用されたパスの例をいくつか示します。 影響 この手法を使用すると、ルートディレクトリ外のファイルを取得でき、誰でも任意のファイルを読み取り・ダウンロードできるようになります。 リクエスト: レスポンス: 概念実証 テンプレート:...
WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin 1.1.0-1.2.2 - Hydra Host+ Host Profile Takeover vulnerability
Hydra Host+ Host Profile Takeover vulnerability discovered by Ossacip Thanh in WordPress Plugin Hydra Booking versions 1.1.0-1.2.2...
CVE-2026-84025
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...
CLEANSTART-2026-HZ27786 Security fixes in rekor-backfill-index 1.2.2-r0
Package rekor-backfill-index version 1.2.2-r0 fixes 7 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2024-6104, ghsa-pmwq-pjrm-6p5r, CVE-2026-2303...
CVE-2026-82821
A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amfobjectget of the file src/amf.c of the component AMF Object Parsing. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been publicly...
CVE-2026-82820
A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amfstringnew of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made publi...
CVE-2026-82227
Contributor SQL Injection in WPBulky = 1.2.2 versions...
CVE-2026-82227
CVE-2026-82227 is a SQL Injection vulnerability in the WordPress plugin WPBulky (WP Bulk Edit Post Types), affecting versions 1.2.2 and earlier . The flaw requires Contributor-level privileges to exploit. CVSS 3.1 scores it 8.5 (HIGH) , with a changed scope, high impact on confidentiality, and lo...
WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by JunHee CHO in WordPress Plugin WPBulky versions = 1.2.2...
PT-2026-83157
Contributor SQL Injection in WPBulky = 1.2.2 versions...
CVE-2026-19358
The CVE-2026-19358 entry concerns a weakness in 3CORESec Trapdoor, affecting the DefaultFunction up to version 1.2.2. The manipulation leads to improper access controls, with the attack described as remotely initiable over the network. Connected documents corroborate the affected component and th...
CVE-2026-19358 3CORESec Trapdoor DefaultFunction access control
A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure...
CVE-2026-19358
A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure...
CVE-2026-65543
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
EUVD-2026-53973
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CLSA-2025-1766019429 TuxCare security update for dompdf/dompdf (7 CVEs)
TuxCare rebuilt dompdf/dompdf to address 7 CVEs. Fixed in 1.2.2-p1+tuxcare...