33906 matches found
EUVD-2025-210752
HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...
EUVD-2025-210751
HCL IntelliOps Event Management IEM is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response...
EUVD-2026-63317
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
EUVD-2026-63302
Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...
EUVD-2026-63303
Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...
EUVD-2026-63340
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
EUVD-2026-63333
Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...
EUVD-2026-63329
Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...
EUVD-2025-210757
Unauthenticated Broken Access Control in Altair = 5.2.2 versions...
EUVD-2025-210756
Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...
EUVD-2025-210755
Unauthenticated SQL Injection in Capella = 2.5.5 versions...
EUVD-2026-63328
Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...
EUVD-2026-63255
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...
EUVD-2026-63224
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...
EUVD-2026-63222
An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...
EUVD-2026-63220
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application...
EUVD-2026-63219
A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives...
EUVD-2026-63218
A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...
EUVD-2026-63217
A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...