CVE-2026-44759

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

EUVD-2026-43589

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-44759

CVE-2026-44759 affects SAP NetWeaver Enterprise Portal. An unauthenticated attacker can inject malicious scripts into a URL parameter, with scripts reflected in server responses and executed in the user’s browser when the crafted URL is visited. This leads to theft of session information, manipul...

CVE-2026-44759 Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

PT-2026-58679

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /exam.php. Such manipulation of the argument day leads to cross site scripting. It is possible to launch the attack remotely. The exploit ...

PT-2026-57940

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-44759: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-15428: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with...

PT-2026-57969

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...

PT-2026-57968

A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add judges.php. This manipulation of the argument fname causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and...

CakePHP 4.6.5 Released

CakePHP 4.6.5 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 4.6.5. This is a maintenance release for the 4.6 branch that fixes community reported issues and two security issues. Advisories will be published for the issues over the next week as...

TRENDnet TEW-635BRM Start HTTPD Code Execution

The vulnerability of the starthttpd function of the Web Service component of TRENDnet TEW-635BRM software lies in the issue where the operation exceeds the buffer boundaries in memory when processing the devicename parameter. Exploiting this vulnerability allows an attacker to execute arbitrary...

Cross-Site Scripting in Domain parameter

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability CWE-80 in FortiSIEM may allow a privileged administrator to execute unauthorized commands via crafted requests...

PT-2026-58113

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user id results in sql injection. It is possible to initiate the attack remotel...

CVE-2026-38450

An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function...

CVE-2026-0515: Improper Handling of Parameters

Insufficient Parameter Validation in the SchedGet system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel...

PT-2026-62048

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Parsing an invalid SVCB Service Binding or HTTPS RR Resource Record can cause a panic when the size of a parameter value overflows the message buffer...

SIP Sustainable Irrigation Platform 5.x (cv) Settings Mass Assignment

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

PT-2026-58725

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description An out-of-bounds read occurs in the multipart processing subsystem when the soup multipart input stream read headers function fails to properly validate the size of incoming multipart boundar...

CVE-2026-15596

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /subject.php. Such manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. The exploit is...