174 matches found
CVE-2026-35201
Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INTMAX are truncated to a signed int before entering the native parser,...
CVE-2025-14532
DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0...
CVE-2025-14532
DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0...
CVE-2025-12462
A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple parameters resulting in Blind SQL Injection. This issue was fixed in versions above 8.0...
CVE-2025-14532 Remote Code Execution via Unrestricted File Upload in DobryCMS
DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0...
EUVD-2025-208154
DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0...
PT-2026-22580
Name of the Vulnerable Software and Affected Versions DobryCMS versions prior to 8.0 Description A Blind SQL injection issue exists in DobryCMS. An unauthenticated remote attacker can inject SQL syntax into a URL path, leading to a Blind SQL injection. The vulnerability allows for the injection o...
CVE-2026-2386
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpaecreatepage AJAX handler authorizing users only with...
CVE-2025-14973: Improper Neutralization of Special Elements used in an SQL Command
The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks...
CVE-2021-0385
In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted WiFi networks due to notification interaction above the lockscreen. This could lead to local escalation of privilege with no additional execution privileges...
EUVD-2025-65484
Malicious code in abovehalibutz3n npm...
EUVD-2025-65483
Malicious code in abovejunglefowlz3n npm...
EUVD-2025-56078
Malicious code in above-apricot-echidna npm...
Malicious code in above-blue-puffin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf5d788a480e941f1b36b843708ab8ec0619ef2693bc8cc761317503301969f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-56075
Malicious code in above-blue-puffin npm...
EUVD-2025-56076
Malicious code in above-beige-hawk npm...
EUVD-2025-56073
Malicious code in above-lime-sheep npm...
Malicious code in above-beige-hawk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d689bdc49f4c3c2908b88030acd8bd522a89ffa400e01a7375ddd928e9c5856 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...