111934 matches found
PT-2026-93333
QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...
CVE-2026-85385: Improper Neutralization of Input During Web Page Generation
Concrete CMS below 9.5.4 did not validate the user timezone value uTimezone on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName returns any non-IANA value unchanged. A stored cross-site scripting payload saved in this field...
CVE-2026-27546: Authentication Bypass Using an Alternate Path or Channel
An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...
PT-2026-93339
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An unauthenticated remote attacker can exploit an authentication bypass in the account log function to gain administrative access, regardless of whether accounts...
PT-2026-93818
Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.25 Description A cross-site request forgery issue exists in the User Management component. A remote attacker can manipulate the UserController::del and UserController::mod functions within the...
PT-2026-93994
Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to perform a SQL injection attack. This occurs due to insufficient validation of...
PT-2026-93826
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update category.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit...
PT-2026-93704
Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization enforcement on the 'GET /admin-api/crm/operatelog/page' endpoint allows any authenticated back-office user to access the installation-wide audit trail. This allows...
PT-2026-93321
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the si...
PT-2026-93705
Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description A missing authorization issue exists in the 'GET /admin-api/crm/flow/flow-users' endpoint. This allows any authenticated back-office user to access sensitive approval workflow data, including...
PT-2026-93701
Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Authenticated back-office users can issue arbitrary invoices due to missing authorization in the CrmInvoiceController issueInvoice function. By calling the PUT '/admin-api/crm/invoice/issue'...
PT-2026-93680
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the NFSD component. A local administrator with CAP SYS ADMIN privileges can crash the kernel by triggering a state-revocation walk before the server...
PT-2026-93391
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the NTFS3 file system. The functions ntfs reparse init and ntfs objid init parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles. Thes...
CVE-2026-92603: Authorization Bypass Through User-Controlled Key
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message r...
CVE-2026-92385: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/updatecategory.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit h...
CVE-2026-92462: Missing Authorization
yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...
CVE-2026-92461: Missing Authorization
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...
PT-2026-93355
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...
PT-2026-93354
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...
PT-2026-93353
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...