CVE-2019-25525 Inout EasyRooms Ultimate Edition v1.0 SQL Injection via search

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the guests parameter. Attackers can send POST requests to the search/rentals endpoint with malicious SQL payloads to...

CVE-2019-25525

CVE-2019-25525 affects Inout EasyRooms Ultimate Edition v1.0. The vulnerability is an SQL injection in the guests parameter that can be exploited via POST to the search/rentals endpoint, enabling unauthenticated attackers to bypass authentication and potentially extract or modify data. The provid...

Nesote Inout EasyRooms SQL注入漏洞

Nesote Inout EasyRooms is a hotel management system developed by Nesote Corporation. Version 1.0 of Nesote Inout EasyRooms has a SQL injection vulnerability. This vulnerability stems from the guests parameter, which allows for SQL injections, potentially enabling unverified attackers to manipulat...

PT-2026-24985

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the guests parameter. Attackers can send POST requests to the search/rentals endpoint with malicious SQL payloads to...

CVE-2026-28790

OliveTin prior to 3000.11.0 allows an unauthenticated guest to terminate running actions via KillAction RPC, despite authRequireGuestsToLogin: true. Guests may access the KillAction endpoint directly and stop actions, causing unauthorized denial of service. This is a broken access control issue w...

CVE-2026-28790 OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, bu...

OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login

Summary OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release 3000.10.2, guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully...

GHSA-4FQM-6FMH-82MQ OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login

Summary OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release 3000.10.2, guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully...

CVE-2026-22717 VMware Workstation out-of-bound read vulnerability

Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to obtain limited information disclosure from the machine where VMware Workstation is installed...

CVE-2026-22716 VMware Workstation out-of-bounds write vulnerability

Out-of-bound write vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to terminate certain Workstation processes...

VMware Workstation 安全漏洞

VMware Workstation is a virtual machine software developed by the American company VMware. This software allows for the running of multiple virtual machines with different operating systems simultaneously. VMware Workstation 25H1 and earlier versions have a security vulnerability that stems from...

VMware Workstation 安全漏洞

VMware Workstation is a virtual machine software developed by the American company VMware. This software enables the creation of virtual machines that can run multiple different operating systems simultaneously. VMware Workstation 25H1 and earlier versions have a security vulnerability caused by...

VMware Workstation和VMware Fusion 安全漏洞

VMware Workstation and VMware Fusion are both products of the American company VMware. VMware Workstation is a virtual machine software that allows for the running of multiple different operating systems within a single virtual machine. VMware Fusion, on the other hand, is a virtual machine...

CVE-2026-1316

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media.href' parameter in all versions up to, and including, 5.97.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers if...

CVE-2026-1316 Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media.href' parameter in all versions up to, and including, 5.97.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers if...

PT-2026-7838

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media.href' parameter in all versions up to, and including, 5.97.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers if...

GHSA-87FH-RC96-6FR6 Unauthenticated Spree Commerce users can access all guest addresses

Summary A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information PII includi...

CVE-2026-24843

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries...

x86: buffer overrun with shadow paging + tracing

ISSUE DESCRIPTION Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing. IMPAC...

MiracleLinux 8 : open-vm-tools-12.3.5-2.el8_10.2 (AXBA:2026-083:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2026-083:01 advisory. - VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files...