CVE-2020-15876: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

PT-2026-81977

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

CVE-2026-75325

DWSurvey v6.14.0 is vulnerable to an authentication bypass flaw. The vulnerability can be triggered via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/ '** parameters. This flaw allows unauthorized access to restricted functionality. No specific remediation, exploit details, or in-the-wild explo...

PT-2026-82226

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.65 Description A remote authenticated attacker with normal privileges can extract all information from the database via a SQL injection. This occurs through the sort parameter in the '/ajax table.php' API endpoint. The issue...

CVE-2026-52473

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder...

PT-2026-82305

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...

PT-2026-82314

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated reflected Cross-Site Scripting XSS issue exists in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a...

EUVD-2026-66743

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...

PT-2026-82302

Name of the Vulnerable Software and Affected Versions Comfast CF-WR630AX version 2.7.0.2 Description A remote attacker can execute arbitrary code through the '/usr/bin/webmgnt' and '/cgi-bin/mbox-config' endpoints by manipulating the timestr and display n parameters. Recommendations At the moment...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031330 advisory. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page...

PT-2026-82097

Name of the Vulnerable Software and Affected Versions Formidable Charts versions prior to 2.0.2 Description An issue exists that allows unauthenticated attackers to perform Directory Traversal, a method used to access files and directories that are stored outside the web root folder. By...

CVE-2020-15876

A SQL injection vulnerability exists in LibreNMS 1.65 within the sort parameter of the /ajax_table.php API endpoint. A remote authenticated attacker with normal privileges can exploit this flaw to extract all information from the LibreNMS database . The vulnerability impacts numerous files, inclu...

EUVD-2026-66661

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

CVE-2026-52473

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges . The vulnerability occurs because the content parameter is directly concatenated to the ProcessBuilder , providing a vector for unauthorized privilege escalation. No specific exploit details, impact assessments, or remedia...

A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks

Large language models LLMs remain vulnerable to jailbreak attacks that exploit techniques such as role-playing, obfuscation, code transformation, and multi-step indirection to elicit harmful outputs. As jailbreak strategies keep emerging, defenses have proliferated in an ongoing cat-and-mouse gam...

CVE-2020-15876

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

CVE-2020-15878: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajaxtable.php API endpoint...

CVE-2026-75330

The front-end interface /superdiamond/preview/projectCode/module/type of super-diamond-server = 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split and string concatenation without being parameterized and bound...

CVE-2026-68000

The front-end interface /cms/category/list of MCMS =6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker $size without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist...

CVE-2026-75364

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...