457310 matches found
CVE-2026-89285: Improper Neutralization of Special Elements used in an SQL Command
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-108694: External Control of File Name or Path
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...
PT-2026-110050
Name of the Vulnerable Software and Affected Versions Topcontent versions prior to 1.2.2 Description An issue exists where a request handler is not properly authorized and HTML sanitization is disabled before storing submitted content. This allows unauthenticated attackers to publish arbitrary...
flatpak security update
1.16.0-9.4 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267891 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267432 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271519 1.16.0-9....
flatpak security update
1.12.9-7 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271507 1.12.9-6 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267897 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267425...
flatpak security update
1.12.9-4.4 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271518 1.12.9-4.3 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267902 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-26743...
CVE-2026-108647
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108636
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...
CVE-2026-108636 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
CVE-2026-108636 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary...
evilarc
evilarc Zweck Mit evilarc können Sie eine ZIP-Datei erstellen, die Dateien mit Directory-Traversal-Zeichen in ihrem eingebetteten Pfad enthält. Die meisten kommerziellen ZIP-Programme winzip usw. verhindern die Extraktion von ZIP-Dateien, deren eingebettete Dateien Pfade mit...
CVE-2026-78530
Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...
CVE-2026-65459
Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...
CVE-2026-66481
Author Arbitrary File Deletion in Presto Player Pro = 3.0.1 versions...
CVE-2026-62129
Contributor Arbitrary File Upload in Creator LMS = 1.2.21 versions...
CVE-2026-62024
Subscriber Arbitrary File Upload in CodeBard Help Desk = 1.1.2 versions...