142 matches found
PT-2026-96760
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking get page content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary...
CVE-2026-66418 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field
OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...
HP BladeSystem Onboard Administrator Panel - Detector
HPBladeSystem Onboard Administrator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HPBladeSystem Onboard Administrator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP...
Unibox Panel - Detect
Unibox Administrator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Unibox Administrator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unibox Panel - Detect', 'description':...
CVE-2026-53448 Coturn: SQL Injection in HTTPS Admin Panel Delete Operations
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The issecurestring filter that protects the STUN protocol path is not...
Mesalvo Meona Client Launcher Component and Mesalvo Meona Server Component have access control error vulnerabilities
The Mesalvo Meona Client Launcher Component and the Mesalvo Meona Server Component are both products of the Mesalvo company. The Mesalvo Meona Client Launcher Component is a component designed for launching clients of medical information systems and facilitating application access. The Mesalvo...
NetArt Media News Lister Cross-site Script Vulnerability
NetArt Media News Lister is a website news management system developed by NetArt Media in Bulgaria. It supports news publishing, article management, and content display. NetArt Media News Lister has a cross-site scripting vulnerability. This vulnerability stems from the title parameter in the new...
CVE-2026-2506
The CVE-2026-2506 entry concerns the EM Cost Calculator plugin for WordPress, affected up to version 2.3.1. The vulnerability is a Stored Cross-Site Scripting flaw caused by attacker-controlled customer_name data being stored and rendered in the admin customer list without output escaping. This e...
CVE-2025-12387
A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service DoS by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes...
CVE-2025-12387 Denial of Service in Pix-Link LV-WR21Q
A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service DoS by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes...
CVE-2025-12387 Denial of Service in Pix-Link LV-WR21Q
A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service DoS by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes...
PT-2026-4913
A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service DoS by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes...
CVE-2025-12387: Improper Check for Unusual or Exceptional Conditions
A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service DoS by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes...
CVE-2026-0733
CVE-2026-0733 affects PHPGurukul Online Course Registration System (versions up to 3.1). The vulnerability is in the file /onlinecourse/admin/manage-students.php where manipulation of the id/cid parameter enables SQL injection. It can be triggered remotely, and multiple sources confirm that the e...
CVE-2025-67436: Improper Neutralization of Special Elements used in a Command
Authenticated Remote Code Execution RCE in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file e.g., home.php...
CVE-2025-67436
Authenticated Remote Code Execution RCE in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file e.g., home.php...
PT-2025-48565
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description Grav CMS contains an Insecure Direct Object Reference IDOR issue within its Admin Panel. This allows users with limited privileges to access sensitive information belonging to other accounts...
Radiometrics VizAir Access Control Vulnerability
Radiometrics VizAir is a weather monitoring and warning system from Radiometrics, Inc. An access control error vulnerability exists in Radiometrics VizAir that originates from unauthenticated access to the administration panel of the VizAir system, which could result in modification of critical...
PT-2025-41929
Name of the Vulnerable Software and Affected Versions Ivanti EPMM versions prior to 12.6.0.2 Ivanti EPMM versions prior to 12.5.0.4 Ivanti EPMM versions prior to 12.4.0.4 Description A path traversal issue exists in the admin panel of Ivanti EPMM. A remote, authenticated attacker with...
