CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-62998

The REDAXO PHP-based content management system is vulnerable to an unauthorized ORDER BY identifier injection in versions prior to 5.21.2 . The root cause is located in rex_list::getSortColumn() within redaxo/src/core/lib/list.php, which fails to verify if a requested column was registered via se...

CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-91818 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...

CVE-2026-87979

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-87979 Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-87979

The Paymob for WooCommerce WordPress plugin, in versions before 4.1.14 , is vulnerable to a security flaw where it fails to verify the request signature on the card-token branch of its payment webhook. This lack of authorization allows unauthenticated attackers to write a card-token record to any...

EUVD-2026-85049

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-87979 Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

Jira Server and Data Center - Information Disclosure

Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the /ViewUserHover.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. Affected versions are before version 7.13.6, from...

EUVD-2026-84976

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

PT-2026-97518

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description Sulu is an open-source PHP content management system based on the Symfony framework. A JCR-SQL2 injection exists in the Smart Content QueryBuilder within...

CVE-2026-62998: Improper Input Validation

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-76087: Authorization Bypass Through User-Controlled Key

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

PT-2026-97435

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before Role-Based Access Control RBAC is applied. Because the 403 to 40...

PT-2026-97434

Name of the Vulnerable Software and Affected Versions GoCD versions 20.2.0 through 26.0.x Description An internal pipeline structure API used for autocompletion during the editing of pipeline, template, environment, and user-preference configurations allows regular authenticated users to access t...

CVE-2026-71458: Observable Response Discrepancy

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-87979: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-92692: Improper Neutralization of Special Elements used in an SQL Command

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...