456741 matches found
CVE-2026-89285: Improper Neutralization of Special Elements used in an SQL Command
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-87764: Improper Neutralization of Input During Web Page Generation
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...
PT-2026-110011
Name of the Vulnerable Software and Affected Versions Anton Extensions versions prior to 1.2.3 Description An issue exists where the plugin fails to perform capability checks, nonce verification, and file-type validation before writing content to a chosen path. This allows unauthenticated attacke...
CVE-2026-108647
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108636
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108636 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
CVE-2026-108636 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
evilarc
evilarc Zweck Mit evilarc können Sie eine ZIP-Datei erstellen, die Dateien mit Directory-Traversal-Zeichen in ihrem eingebetteten Pfad enthält. Die meisten kommerziellen ZIP-Programme winzip usw. verhindern die Extraktion von ZIP-Dateien, deren eingebettete Dateien Pfade mit...
CVE-2026-78530
Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...
CVE-2026-65459
Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...
CVE-2026-66481
Author Arbitrary File Deletion in Presto Player Pro = 3.0.1 versions...
CVE-2026-62129
Contributor Arbitrary File Upload in Creator LMS = 1.2.21 versions...
CVE-2026-62024
Subscriber Arbitrary File Upload in CodeBard Help Desk = 1.1.2 versions...
CVE-2026-62025
Unauthenticated Arbitrary File Upload in Tailored Tools = 3.0.3 versions...
CVE-2026-40805
Subscriber Arbitrary File Deletion in PeepSo = 9.0.5.4 versions...
CVE-2026-98266
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA subsystem. When an audio card is released asynchronously, such as during the disconnection of a USB sound device, active background tasks may continue accessing the device structure after it has been deallocated due to...
CVE-2026-108603
The slide-maker software (versions through 5.8.0 ) contains a path traversal vulnerability in the generate_images_openai.py component. The root cause is the application's failure to sanitize manifest-supplied filenames, allowing attackers to use ../ sequences or symlinked filenames to write image...