94745 matches found
EUVD-2026-48280
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...
CVE-2026-65689
Bold Reports Standalone Report Designer before 14.1.12 is affected by a path traversal vulnerability in the database download feature that allows unauthenticated attackers to read arbitrary files on the server filesystem, including authentication credentials, potentially giving full unauthorized ...
CVE-2026-65689 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...
CVE-2026-65494
Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-65451
Contributor SQL Injection in MapSVG = 8.14.0 versions...
CVE-2026-61950
Unauthenticated SQL Injection in TrueBooker = 1.2.3 versions...
CVE-2026-61947
Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...
CVE-2026-59555
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.3 versions...
CVE-2026-59525
Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...
CVE-2026-59526
Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...
CVE-2026-27423
Subscriber Broken Access Control in Participants Database = 2.7.8.4 versions...
CVE-2026-65605
SiYuan prior to v3.7.2 is vulnerable to a stored XSS in the Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, with EscapeHTML applied only when HasUnclosedHtmlTag is true; balanced self-closing tags like can bypass this...
EUVD-2026-48241
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval
SummaryThe FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution. DetailsThe FileCatalog...
EUVD-2026-48133
Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...
CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...
EUVD-2026-48216
Contributor SQL Injection in MapSVG = 8.14.0 versions...
CVE-2026-61947 WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...