CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

The vulnerability of the mask_sensitive_config() function on the security monitoring and threat detection platform Wazuh allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the masksensitiveconfig function on the security monitoring and threat detection platform provided by Wazuh is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access t...

CVE-2026-84481: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.ph...

CVE-2026-68525

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

SQL Injection

WsgiDAV is vulnerable to SQL Injection. The vulnerability is due to the MySQLBrowserProvider directly concatenating a record key from the request URL into SQL WHERE clauses, which allows an attacker with access to a share configured with this non-default provider to inject malicious SQL through a...

piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summary piccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET. The sessions table stores live session tokens in plaintext, and the token column is not marked...

CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

CVE-2026-81733

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...

CVE-2026-81733 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...

CVE-2026-81733

WWBN AVideo through version 30.0 (and master up to commit 4cb576e) is affected by a cross-site request forgery (CSRF) vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint accepts customUrl, customMessage, and autoRedirect parameters via a GET request and only verifies that the ...

CVE-2026-81733 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...

CVE-2026-82181: Use of GET Request Method With Sensitive Query Strings

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

CVE-2026-55509: Improper Neutralization of Special Elements used in an SQL Command

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-76179: Use of GET Request Method With Sensitive Query Strings

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

PT-2026-83270

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse query string to process...

PT-2026-83081

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $ REQUEST via a GET...

CVE-2026-76179 Ebyte NE2-D11 Use of GET Request Method With Sensitive Query Strings

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...