111894 matches found
CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
SUSE CVE-2026-73546
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...
CLEANSTART-2026-GB37349 flaw was found in the admin REST API of Keycloak, a solution for identity and access management
Security vulnerability affects the keycloak package. A flaw was found in the admin REST API of Keycloak, a solution for identity and access management...
CVE-2026-94000: Missing Authorization
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...
PT-2026-95748
Name of the Vulnerable Software and Affected Versions Pochipp versions prior to 1.20.3 Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application...
CVE-2026-94001: Missing Authorization
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...
PT-2026-95760
Name of the Vulnerable Software and Affected Versions Master Blocks versions prior to 1.5.0 Description An authorization flaw exists in a REST route that allows unauthenticated users to update plugin settings. This includes the ability to modify a value that is output unescaped in the...
PT-2026-95780
Name of the Vulnerable Software and Affected Versions Quill Forms | Conversational Multi Step Forms, Surveys & quizzes versions prior to 5.7.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique...
PT-2026-95872
Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description Authenticated back-office users can read arbitrary files due to a path traversal issue in the getEmailHTML action of the 'admin/ajax.php' endpoint. By providing relative path sequences in the email...
CVE-2026-93988: Improper Limitation of a Pathname to a Restricted Directory
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
PT-2026-95826
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The issue resides in the group-membership endpoints, where the system does not verify if a group grants administrative privileges before...
CVE-2026-15664: Improper Neutralization of Input During Web Page Generation
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-88824: Improper Neutralization of Input During Web Page Generation
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...
CVE-2026-12042: Improper Neutralization of Input During Web Page Generation
The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
PT-2026-95827
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The endpoint used for deleting user credentials fails to correctly verify fine-grained reset-password permissions. This allows a delegated...
CVE-2019-25776 Weaver E-cology SQL Injection via SyncUserInfo.jsp
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping...
EUVD-2026-83201
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...
GHSA-JR78-W6W5-M8F8 Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
Summary The api.php?action=smwtask API module performs no authorization check. The equivalent maintenance interface in the web UI Special:SMWAdmin requires the smw-admin right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore...
CVE-2026-84400
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of...