457080 matches found
CVE-2026-108647
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108636
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108636 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
CVE-2026-108636 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
evilarc
evilarc Zweck Mit evilarc können Sie eine ZIP-Datei erstellen, die Dateien mit Directory-Traversal-Zeichen in ihrem eingebetteten Pfad enthält. Die meisten kommerziellen ZIP-Programme winzip usw. verhindern die Extraktion von ZIP-Dateien, deren eingebettete Dateien Pfade mit...
CVE-2026-78530
Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...
CVE-2026-65459
Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...
CVE-2026-66481
Author Arbitrary File Deletion in Presto Player Pro = 3.0.1 versions...
CVE-2026-62129
Contributor Arbitrary File Upload in Creator LMS = 1.2.21 versions...
CVE-2026-62024
Subscriber Arbitrary File Upload in CodeBard Help Desk = 1.1.2 versions...
CVE-2026-62025
Unauthenticated Arbitrary File Upload in Tailored Tools = 3.0.3 versions...
CVE-2026-40805
Subscriber Arbitrary File Deletion in PeepSo = 9.0.5.4 versions...
CVE-2026-98266
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA subsystem. When an audio card is released asynchronously, such as during the disconnection of a USB sound device, active background tasks may continue accessing the device structure after it has been deallocated due to...
CVE-2026-108603
The slide-maker software (versions through 5.8.0 ) contains a path traversal vulnerability in the generate_images_openai.py component. The root cause is the application's failure to sanitize manifest-supplied filenames, allowing attackers to use ../ sequences or symlinked filenames to write image...
CVE-2026-78530
The WordPress FoodBakery theme (versions
CVE-2026-78530 WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...
