13537 matches found
CVE-2026-90574: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been...
PT-2026-90865
A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed...
CVE-2026-90767: Improper Neutralization of CRLF Sequences
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...
CVE-2026-90527: Improper Neutralization of Input During Web Page Generation
A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed...
CVE-2026-87759
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...
CVE-2026-87759
The Add User Autocomplete WordPress plugin, in versions before 1.2 , contains a privilege escalation vulnerability. The plugin fails to perform necessary capability or nonce checks when creating pending site-membership invitations. This allows any authenticated user , such as a subscriber, to pro...
EUVD-2026-76798
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...
CVE-2026-87759 Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...
CVE-2026-87759 Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...
EUVD-2026-76794
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...
CVE-2026-87759: Improper Privilege Management
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...
PT-2026-90582
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...
CVE-2026-80986
In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...
CVE-2026-89264: Authorization Bypass Through User-Controlled Key
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...
PT-2026-90165
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the IOMMU subsystem when the device add function fails within the iommu mock device add function. The process begins with iommu fwspec init, which allocates both...
CVE-2026-73698 FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...
CVE-2026-85217
A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy...
EUVD-2026-75449
A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy...
CVE-2026-85217 Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop
A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy...
CVE-2026-85217
Autodesk Fusion Desktop is vulnerable to a Man-in-the-Middle (MITM) attack via a maliciously crafted add-in that, when installed and executed, can modify persistent network proxy settings without user notification or consent. A successful exploit allows an attacker to redirect authenticated Fusio...