11887 matches found
CVE-2026-7753
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...
EUVD-2026-53033
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...
PT-2026-67964
Name of the Vulnerable Software and Affected Versions Cost Calculator Builder versions prior to 3.6.18 Description An issue allows authenticated users with Subscriber-level access and above to gain unauthorized access to sensitive data. The cost-calculator-custom-export-run AJAX action, handled b...
PT-2026-68026
Name of the Vulnerable Software and Affected Versions Askeet versions prior to 3.1 Description The Askeet plugin for WordPress contains a flaw allowing authenticated attackers with Administrator-level access and above to perform SQL Injection. The issue exists within the sql query parameter used ...
Directory Traversal
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Directory Traversal in the database backup and export filename handling through the backup/export filename processing in the admin backend and exporter modules. An administrator-level attacker can overwrit...
EUVD-2026-52974
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...
CVE-2026-70592 Ghost: Database Backup Path Traversal
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...
CVE-2026-70592 Ghost: Database Backup Path Traversal
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...
Exploit for CVE-2026-17566
CVE-2026-17566 — pgAdmin 4 Import/Export Data RCE PoC The p...
CVE-2026-6837
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...
CVE-2026-6837
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...
EUVD-2026-52566
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...
CVE-2026-6837
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...
CVE-2026-6837
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...
CSV Injection
Overview Affected versions of this package are vulnerable to CSV Injection via the visit export process. An attacker can cause arbitrary spreadsheet formulas to be embedded in exported CSV files by supplying specially crafted values in the User-Agent, Referer, or request path headers that begin...
ALSA-2026:50141 Important: sg3_utils security, bug fix, and enhancement update
The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...
ALSA-2026:50142 Important: sg3_utils security, bug fix, and enhancement update
The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...
CVE-2026-70592: Improper Limitation of a Pathname to a Restricted Directory
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...
PT-2026-67885
Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.1 through 6.54.0 Description An Administrator-level user can remotely overwrite specific files on the filesystem, which may result in integrity and availability issues. This occurs because the database export endpoint does...
CVE-2026-6837: Improper Neutralization of Special Elements used in an OS Command
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...