110148 matches found
Vulnerabilty-Assessment-Detection-Lab
Vulnerability Assessment & Detection Lab End-to-end vulnerabi...
CVE-2026-72710
SPIP versions before 4.4.18 contain a critical remote code execution vulnerability in the editer_objet action. The arg parameter resolves SQL table names without enforcing an editable-columns allowlist, allowing an attacker with a valid nonce to supply arg=job/0 with crafted fonction and args val...
EUVD-2026-76156
SPIP before 4.4.18 contains a remote code execution vulnerability in the editerobjet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spipjobs table. Attackers...
SUSE CVE-2026-88879
Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...
WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability
WordPress Masteriyo - LMS plugin = 3.4.0 - PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 3.4.0...
WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...
WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by LueRader in WordPress Plugin Everest Forms versions = 3.6.0...
WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...
WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...
CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...
AZL-101766 CVE-2026-89161 affecting package php 8.3.33-1
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...
AZL-101760 CVE-2026-89157 affecting package php 8.3.33-1
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...
CVE-2026-79362
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
PT-2026-90043
Name of the Vulnerable Software and Affected Versions Woltlab Suite Core versions 6.1.0 through 6.1.22 Woltlab Suite Core versions 6.2.0 through 6.2.5 Description An authenticated low-privileged user can achieve remote code execution through cache poisoning. The issue occurs when...
CVE-2026-79362
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...
PT-2026-90020
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37983)
Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure of the /pages/custedit1.php file to properly validate the ID...
SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37987)
Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper filtering of the ID parameter in the /pages/emp Edit1.php...