CVE-2026-36341

Vulnerabilidad de Cross-Site Scripting XSS en Webkul Krayin CRM Inyección HTML CVE: CVE-2026-36341 Resumen La vulnerabilidad es particularmente crítica porque afecta al Panel de Administración. En muchos flujos de trabajo de CRM, los gerentes o administradores de nivel superior revisan las...

CVE-2026-22010-Android-Intent-Redirection-to-Exported-Component

CVE-2026-22010 – Redirección de Intent de Android a Componente Exportado Código del programa simulación Java/Android // VulnActivity.java - Exported activity that forwards intents public class VulnActivity extends Activity @Override protected void onCreateBundle b super.onCreateb; Intent incoming...

CVE-2020-0096-StrandHogg2

此设计缺陷使攻击者可以在另一个应用程序的顶部显示其自己的活动（页面），从而可能使用户迷失自己的私人数据。该漏洞被称为StrandHogg 2.0，最近由挪威安全公司Promon披露。 范围：理论上是全版本 android10测试失败了，测试8.0.1测试成功 验证步骤： 修改代码为目标app的包名和导出的activity 启动目标app的目标activity 启动测试app 在启动目标app发现劫持成功 LINKS https://source.android.com/security/bulletin/2020-05-01...

CVE-2026-62085

Administrator SQL Injection in WP Activity Log = 5.6.6 versions...

CVE-2026-62085 WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability

Administrator SQL Injection in WP Activity Log = 5.6.6 versions...

CVE-2026-62085

The WordPress WP Activity Log plugin (versions

CVE-2026-62085 WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability

Administrator SQL Injection in WP Activity Log = 5.6.6 versions...

EUVD-2026-89822

Administrator SQL Injection in WP Activity Log = 5.6.6 versions...

WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Activity Log versions = 5.6.6...

CVE-2025-60503

CVE-2025-60503 — UltimatePOS UltimateFosters v4.8 中的存储型跨站脚本（XSS）漏洞 发布日期： 2025-10-30 CVE ID： CVE-2025-60503 已预留 研究人员： Vivien Lebas 厂商： UltimateFosters 产品： UltimatePOS 受影响版本： 4.8 漏洞类型： 存储型跨站脚本（XSS） 严重性： 高危 概述 UltimatePOS 管理后台（v4.8）存在一个存储型 XSS 漏洞。 采购 模块中的参考编号 字段接受未经清理的用户输入，之后在报表 → 活动日志 页面渲染时未进行适当转义。...

CVE-2023-4281

CVE编号: CVE-2023-4281 漏洞类型: IP地址欺骗 描述: Activity Log 插件从潜在不可信的头部中获取客户端 IP 地址，攻击者可操纵其值。这可能被用于隐藏恶意流量的来源。 复现步骤: Run the following code in the web browser and note on the backend that the IP address has been faked. await fetch"/wp-login.php", "headers": "content-type":...

CVE-2026-101046

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/id/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL...

CVE-2026-101046 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/id/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL...

CVE-2026-101046: Improper Neutralization of Special Elements used in an SQL Command

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/id/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL...

CVE-2026-15273

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

CVE-2026-15273 Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

CVE-2026-15273 Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

CVE-2026-15273

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in version 4.0.0 . The root cause is insufficient input sanitization and output escaping related to the REQUEST_URI . This flaw allows unauthenticated attackers to inject arbitrary web scripts, which execute...

EUVD-2026-87526

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...