CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-66470

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2...

CVE-2026-5219: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...

CVE-2026-12722: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2...

PT-2026-66472

Name of the Vulnerable Software and Affected Versions E-Commerce Pack versions prior to 5.03.01.49 Description A Cross-Site Request Forgery CSRF flaw exists in the software. CSRF is a type of attack that tricks a victim into submitting a malicious request. It allows an attacker to perform...

CVE-2025-10656: Incorrect Authorization

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the userfilter function. This makes it possible for unauthenticated attackers to create admin accounts...

Fanwei OA E-Office - Information Disclosure Detection

Fanwei E-Office mysqlconfig.ini file can be directly accessed, leaking database account password and other information. !/usr/bin/env python3 -- coding: utf-8 -- """Fanwei E-Office mysqlconfig.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress e-search <=1.0 - Cross-Site Scripting Detection

Wordpress plugin e-search 1.0 and before contains a cross-site scripting vulnerability via dateselect.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Linux Distros Unpatched Vulnerability : CVE-2026-64264

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes...

CVE-2026-24727

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

EUVD-2026-48530

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

CVE-2026-24727: Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive...

Exploit for Improper Authentication in Oracle Concurrent_Processing

CVE-2025-61882 — Oracle E-Business Suite Unauthenticated Remot...

Oracle Critical Patch Update, July 2026 Security Update Review

Oracle released its third quarterly edition of this year’s Critical Patch Update. The update received patches for 1449 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families,...

UBUNTU-CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

Vulnerabilities in Oracle E-Business Suite components

Oracle has identified several vulnerabilities in the Oracle E-Business Suite, including various modules such as Work in Process, Application Object Library, HRMS, Applications Framework, Advanced Collections, Advanced Outbound Telephony, Advanced Pricing, Applications DBA, Bills of Material,...

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...