Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues. id: CVE-2017-18556 info: name: Google Analytics by BestWebSoft 1.7.1 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-google-analytics plugin before 1.7.1 for WordPress has...

Sentinel-GPT

Sentinel-GPT: Agentic AI for Threat Hunting 🛡️ An automated cybersecurity pipeline that transforms raw Azure logs into actionable intelligence using LLM-based reasoning. 📖 Overview Sentinel-GPT is an AI Agent specialised for threat hunting in cybersecurity. It is integrated with Azure Log Analytic...

WordPress-NotificationX-CVE-2024-1698

Set-up docker-compose up --build Clean up docker-compose down Testing Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null-- -'...

CVE-2024-1698-Exploit

CVE-2024-1698 Exploit Script - Wordpress NotificationX = 2.8.2 - SQL Injection This is an exploit script to find out wordpress admin's username and password hash by exploiting CVE-2024-1698. This Python script is intended for educational purposes only. It demonstrates a proof of concept for...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics 1.7.3 - Remote Code Execution Exploit v2 Working exploit for Open Web Analytics 1.7.3 - RCE enhenced with pentestmonkey's php reverse shell, Fixed issue of not able to find user in cache. Original soruce exploit can be found on here Usage Add your attacker...

VulnCheck KEV: CVE-2022-24637

Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '?php instead of the intended "?php sequence aren't handled by the PH...

CVE-2026-114697

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1...

EUVD-2026-109253

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1...

CVE-2026-114697 WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1...

CVE-2026-114697

The WordPress QA Analytics plugin (qa-heatmap-analytics) is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.3.0.1 . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to store malicious scripts...

CVE-2021-26855-CVE-2021-27065

CVE-2021-26855-CVE-2021-27065 analytics ProxyLogo Mail exchange RCE...

CVE-2026-115657

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy...

EUVD-2026-108631

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy...

CVE-2026-115657

The KNIME Analytics Platform (LTS versions before 5.8.4 ) is vulnerable to a sensitive information disclosure flaw when used as an executor in KNIME Server or KNIME Business Hub . During startup, the software logs the configured credentials of proxies, allowing an attacker with access to the log ...

CVE-2026-115657 KNIME Analytics Platform logs credentials of configured proxy when used as an executor

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy...

WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by leon figueira in WordPress Plugin QA Analytics versions = 5.3.0.1...

Vulnerabilities in Oracle Analytics

Oracle has identified 33 vulnerabilities in various Oracle Analytics products, including Oracle Business Intelligence Enterprise Edition and Oracle BI Publisher. The patch notes list these 33 vulnerabilities, among which 14 can be exploited remotely without the need for authentication. Depending ...

CVE-2026-114081 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114081

The software Trigger.dev before version 4.5.6 is vulnerable to a cross-tenant SQL injection in its TSQL query compiler. The root cause is the improper concatenation of window-function names into generated ClickHouse SQL without adequate escaping or allowlisting. Authenticated customers can exploi...

CVE-2026-114081 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...