135483 matches found
EUVD-2026-80817
RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection...
CVE-2026-93014
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
EUVD-2026-81683
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-61793
nuxt-og-image (NPM module for Nuxt.js), versions >= 6.0.2,
CVE-2026-14850
MobiAPParc has a vulnerability in its password reset functionality caused by improper validation of the user_id parameter . Because this numeric identifier is predictable, an unauthenticated attacker over the network can reset passwords for arbitrary users without proving account ownership , lead...
BIT-MONGODB-2026-18688 Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash denial of service and may potentially expose ...
CVE-2026-87963
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
EUVD-2026-81385
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-87963
The Yo WordPress plugin (versions 1.1 through 1.3.1 ) is affected by an unauthenticated SQL injection vulnerability. The plugin does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its built-in request escaping. An ...
CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
Exploit for CVE-2026-67401
CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
CVE-2026-90923
The Autopay WordPress plugin (versions before 5.0.1 ) is vulnerable to an incorrect authorization flaw because it fails to enforce signatures on specific payment callbacks. This security weakness allows unauthenticated users to perform cross-customer actions, specifically the disclosure and delet...
CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
EUVD-2026-81281
In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...
CVE-2026-52483
The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...