Lucene search
+L

5465 matches found

attackerkb
attackerkb
•added 2026/07/31 6:29 p.m.•15 views

CVE-2026-57232

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

3.1CVSS5.5AI score0.0029EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
•added 2026/07/31 6:29 p.m.•50 views

CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

3.1CVSS0.0029EPSS
SaveExploits0References3
CVE
CVE
•added 2026/07/31 6:29 p.m.•61 views

CVE-2026-57232

CVE-2026-57232 affects Contao core-bundle's Feed Reader module. From versions 5.3.35–5.3.47 and 5.7.0-RC1–5.7.8, FeedReaderController::getResponse() passes feed URLs directly to the HTTP client via feedIo->read() without validating schemes or private addresses, enabling a backend user with mod...

3.1CVSS5.5AI score0.0029EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
•added 2026/07/31 6:29 p.m.•9 views

CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

3.1CVSS5.5AI score0.0029EPSS
SaveExploits0References3
OSV
OSV
•added 2026/07/31 6:29 p.m.•14 views

CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

3.1CVSS5.5AI score
SaveExploits0References5
NVD
NVD
•added 2026/07/31 2:16 p.m.•18 views

CVE-2026-65636

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

2.1CVSS0.00197EPSS
SaveExploits0References5
OSV
OSV
•added 2026/07/31 1:29 p.m.•10 views

EEF-CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments

Summary Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a...

2.1CVSS6.1AI score0.00197EPSS
SaveExploits0References5
attackerkb
attackerkb
•added 2026/07/31 1:29 p.m.•10 views

CVE-2026-65636

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

2.1CVSS5.7AI score0.00197EPSS
SaveExploits0References6Affected Software1
NVD
NVD
•added 2026/07/31 7:16 a.m.•21 views

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

8.1CVSS0.00386EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/07/31 6:00 a.m.•18 views

EUVD-2026-51427

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

8.1CVSS5.9AI score0.00386EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/07/31 6:00 a.m.•49 views

CVE-2026-15258 Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

0.00386EPSS
SaveExploits0References1
Patchstack
Patchstack
•added 2026/07/31 6:00 a.m.•10 views

WordPress Product Feed Manager For WooCommerce plugin < 7.6.1 - Contributor+ SQL Injection vulnerability

Contributor+ SQL Injection vulnerability discovered by Md Amin Ullah Sheikh in WordPress Plugin Product Feed Manager versions 7.6.1...

8.1CVSS5.8AI score0.00386EPSS
SaveExploits0References1Affected Software1
CVE
CVE
•added 2026/07/31 6:00 a.m.•43 views

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

5.9AI score0.00386EPSS
SaveExploits0References1
attackerkb
attackerkb
•added 2026/07/31 6:00 a.m.•11 views

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

5.7AI score0.00386EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/07/31 6:00 a.m.•16 views

CVE-2026-15258 Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

5.7AI score0.00386EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/07/31 12:00 a.m.•20 views

PT-2026-66716

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

5.7AI score0.00386EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/31 12:00 a.m.•30 views

PT-2026-66757

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

2.1CVSS5.7AI score0.00197EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/07/31 12:00 a.m.•25 views

PT-2026-66837

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

3.1CVSS5.5AI score0.0029EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
•added 2026/07/30 4:55 p.m.•11 views

SUSE CVE-2026-35601

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar propert...

4.1CVSS7.8AI score0.00323EPSS
SaveExploits1References2
SUSE CVE
SUSE CVE
•added 2026/07/30 4:54 p.m.•11 views

SUSE CVE-2026-40885

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and th...

8.8CVSS7.7AI score0.00451EPSS
SaveExploits1References2
Rows per page
Query Builder