83 matches found
PT-2026-114078
Name of the Vulnerable Software and Affected Versions pypdftk versions prior to 0.6 Description An OS command injection issue exists in the fill form, dump data fields, and pdftk cmd util functions. The software constructs shell commands using paths provided by the caller. An attacker who can...
PT-2026-103054
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data fields list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
PT-2026-96216
Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description The '/api/importer/row/' and '/api/importer/mapping/' endpoints fail to scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. This allows any...
EUVD-2022-56046
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...
NPM: MeshCentral has unsanitized data fields
NPM: MeshCentral has unsanitized data fields vulnerability discovered by ? in WordPress Npm meshcentral versions 1.1.60...
CVE-2026-16589
The WP Directory Kit WordPress plugin, in versions prior to 1.5.5 , is vulnerable to SQL injection . The root cause is the failure to sanitize and escape the data_fields_list parameter before its use in a SQL statement during an authenticated AJAX action. This action further lacks necessary autho...
CVE-2026-16589 WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...
ROS-20260709-73-0012
The vulnerability in MediaWiki relates to the disclosure of information in erroneous data fields. Exploiting this vulnerability can allow an attacker who operates remotely to gain unauthorized access to protected information...
CVE-2025-65104 Firebird: Information leak vulnerability in firebird3 client when used with newer server
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or...
CVE-2026-33405
Pi-hole Admin Interface (Pi-hole) versions 6.0–6.5 are affected by a stored HTML injection in the formatInfo() function of queries.js, which renders data.upstream, data.client.ip, and data.ede.text without escaping when expanding a Query Log row. The vulnerability could allow HTML injection despi...
Flowise security vulnerabilities
Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior versions of Flowise, including 3.0.13, contained security vulnerabilities. These vulnerabilities stemmed from the possibility for unverified users to inject arbitrary values into internal...
Smoothwall Express Cross-Site Scripting Vulnerability (CNVD-2026-14283)
Smoothwall Express is Smoothwall open source a GNU/Linux-based firewall operating system . Smoothwall Express cross-site scripting vulnerability , the vulnerability stems from the hosts.cgi script in the IP, HOSTNAME or COMMENT parameter on the user-supplied data lack of effective filtering and...
Code-Projects Online Product Reservation System SQL Injection Vulnerability
Code-Projects Online Product Reservation System is a Code-Projects open source online product reservation system. Code-Projects Online Product Reservation System version 1.0 has a SQL injection vulnerability, the vulnerability stems from the parameters fname/lname/...
CVE-2025-64515: Improper Input Validation
Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields...
EUVD-2021-22161
Malware in sbrugna...
EUVD-2012-6215
Malware in sbrugna...
EUVD-2023-27668
Malicious code in bioql PyPI...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper validation of user input in the datacode, datalang0key, datalang0value, datalang1key, and datatitle parameters within the /apprain/developer/language/lipsum.xml process. An attacker can execute...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper validation of user input in the datacode, datalang0key, datalang0value, datalang1key, and datatitle parameters within the /apprain/developer/language/default.xml process. An attacker can execute...
