1138 matches found
WordPress Meta SEO <= 4.5.2 - Open Redirect
The WP Meta SEO WordPress plugin before 4.5.3 did not authorize several AJAX actions, which allowed low-privilege users to update certain data and resulted in an arbitrary redirect vulnerability. id: CVE-2023-0876 info: name: WordPress Meta SEO = 4.5.2 - Open Redirect author: Khalid6468 severity:...
CVE-2026-116059
The LetsRecover WordPress plugin (version 1.2.0 and below ) is vulnerable to an unauthenticated SQL injection due to improper sanitization of user-supplied values. Specifically, a value used as a database column name in an unauthenticated AJAX action can be manipulated to append malicious SQL. At...
CVE-2026-116059 LetsRecover <= 1.2.0 - Unauthenticated SQL Injection
The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned...
CVE-2026-120153
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...
CVE-2026-114466
Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...
CVE-2026-114466
A flaw in the Git git-fast-import(1) and git-fast-export(1) features allows for insufficient granularity of access control . Specifically, certain features within the fast-import utility do not properly restrict filesystem operations, enabling an attacker to supply crafted instructions to access ...
EUVD-2026-124399
Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...
CVE-2026-114466 Insufficient Granularity of Access Control in Git
Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...
CVE-2026-114466 Insufficient Granularity of Access Control in Git
Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...
CVE-2026-114466
Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...
CVE-2026-100144
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...
EUVD-2026-117349
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...
PT-2026-137391
Name of the Vulnerable Software and Affected Versions IVPAY payments versions prior to 1.0.9 Description The plugin fails to sanitize a value from its payment callback before incorporating it into a SQL statement. Additionally, the system accepts an empty API key, which is the default setting, as...
CVE-2026-107040
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...
CVE-2026-107032
Insecure permissions in Bulk Share : Location Sender v2.1.0 versionCode 5 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...
CVE-2026-107027
Insecure permissions in lz233 Tarnhelm v1.8.2 versionCode 20250630 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...
CVE-2026-107029: n/a: Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading…
Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...
CVE-2026-107038: n/a: Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an…
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data...
EUVD-2026-113174
Insecure permissions in Bulk Share : Location Sender v2.1.0 versionCode 5 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...
