13522 matches found
CVE-2023-26982
CVE-2023-26982 Vulnerability Explanation: Trudesk v1.2.6 was discovered to contain a stored cross-site scripting XSS vulnerability via the Add Tags parameter under the Create Ticket function. Attack Vectors: The attacker must create some ticket and then edit tags in the ticket and insert the XSS...
CVE-2022-24734
CVE-2022-24734 PoC An RCE can be obtained on MyBB's Admin CP in Configuration - Add New Setting. The user must have a rights to add or update setting. This is tested on MyBB 1.8.29. Sources: https://github.com/mybb/mybb/ https://vulners.com/cve/CVE-2022-24734...
freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...
CVE-2024-33209
CVE-2024-33209 FlatPress 1.3. is vulnerable to Cross Site Scripting XSS. An attacker can inject malicious JavaScript code into the "Add New Entry" section, which allows them to execute arbitrary code in the context of a victim's web browser. Vulnerability Type: Cross Site Scripting XSS Vendor of...
CVE-2024-51430
CVE-2024-51430 Vulnerability Type Cross-Site Scripting XSS Description Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component Vendor of...
CVE-2025-25460
FlatPress CMS Stored XSS in v1.3.1 CVE-2025-25460 Author: Athul S Description A stored Cross-Site Scripting XSS vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts...
CVE-2024-50968
CVE-2024-50968 Description A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker...
cve-2025-0364
CVE-2025-0364: BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE The BigAntSoft BigAnt Server, which provides a Windows hosted on-premises chat server that focuses on business use cases, is vulnerable to unauthenticated remote code execution via account registration and PHP...
CVE-2026-100303
The TDuck survey form (versions through 6.0 ) is vulnerable to a broken access control issue due to missing authorization checks on the FormThemeController write endpoints. This allows authenticated non-admin users to perform unauthorized actions, such as adding, modifying, or deleting global for...
UBUNTU-CVE-2026-97997
In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...
CVE-2026-97997
In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...
PT-2026-98466
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel panic occurs when CPUs are hotplug added during the execution of the perf stat command using the pai crypto/CRYPTO ALL/ event. The issue stems from a missing allocation of per-C...
Linux Distros Unpatched Vulnerability : CVE-2026-98123
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by...
SQL Injection
Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...
SQL Injection
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...
GHSA-RW77-VQ4G-X3HP phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...
CVE-2026-76578
CVE-2026-76578 — FreeIPA 익명 관리자 탈취 제품: FreeIPA 4.9.x – 4.13.3 심각도: 치명적 CVSS 9.8 수정됨: FreeIPA 4.13.4 / 389-ds-base 3.2.0-10.el102 RHSA-2026:64785 법적 고지 이 개념 증명proof-of-concept은 승인된 보안 연구 및 취약점 검증을 목적으로 격리된, 개인이 소유한 랩 환경 내에서만 개발되고 실행되었습니다. 이 스크립트를 사용하기 전에: 본인이 소유하거나 테스트 권한을 명시적으로 부여받은 시스템에만 사용하십시오 ...
CVE-2025-56219
CVE-2025-56219 속도 제한 부재 – 사용자 추가 API 설명 공격자는 짧은 시간 안에 대량의 사용자를 자동으로 생성하여 DoS서비스 거부를 유발할 수 있습니다. CVSS 점수: 7.1 높음 공격 유형 원격 인증됨 영향을 받는 버전 8.6.8 이하 버전 제품 공급업체 Ascertia 영향을 받는 제품 코드 베이스 SigningHub 영향을 받는 구성 요소 사용자 추가 API. 완화 조치 사용자 추가 API에 속도 제한을 구현합니다. 취약점 상세 정보 이 애플리케이션은 속도 제한이나 스로틀링 없이 사용자가 새 사용자 계...