CVE-2026-92730

LimeSurvey Community Edition 7.0.14 is vulnerable to a reflected cross-site scripting (XSS) flaw on the administrative survey-participant CSV import result page. The root cause is triggered via an invalid attribute column name . Exploitation details and specific remediation steps are not provided...

EUVD-2026-85521

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...

CVE-2026-92730 LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...

CVE-2026-91775 LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings

LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface...

WordPress Import and export users and customers plugin <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by khanhnv in WordPress Plugin Import and export users and customers versions = 2.4.17...

CVE-2026-84787

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-84787 Privilege Escalation vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-84787

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are vulnerable to a Privilege Escalation vulnerability. An authenticated low-privilege user can gain Administrator privileges by exploiting the Report Profile import functionality. The vulnerability carries a base s...

EUVD-2026-85262

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-91024

The Booking Manager WordPress plugin (versions before 2.1.21 ) is vulnerable to SQL injection due to improper neutralization of special elements. The root cause is the failure to sanitize and escape values retrieved from a fetched external iCalendar feed before incorporating them into a SQL query...

CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

Linux Distros Unpatched Vulnerability : CVE-2026-63273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from...

Linux Distros Unpatched Vulnerability : CVE-2026-63274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's o...

Fedora 45 : postgresql16-anonymizer (2026-bc7408de42)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bc7408de42 advisory. Upstream changelog: https://gitlab.com/dalibo/postgresqlanonymizer/-/releases - core CVE-2026-19633: Escalation via custom types, operators and...

CVE-2026-88416

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

cve-2025-54313

cve-2025-54313 Revisa proyectos en busca de paquetes comprometidos, archivos sospechosos y declaraciones de importación, véase ataque a la cadena de suministro ¿Cómo? Simplemente ejecute el script en la terminal/consola. Considere instalar maple primero. root@kitploit: npm install -g maple chmod ...

CVE-2025-9215

StoreEngine Plugin de comercio electrónico potente para WordPress para pagos, membresías, afiliados, ventas y más = 1.4.0 - Descarga arbitraria de archivos autenticada Suscriptor+ El plugin StoreEngine contiene una vulnerabilidad en su función de Importación/Exportación CSV que permite a cualquie...

CVE-2026-83803

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes...

CVE-2021-46364

CVE-2021-46364: Deserialización de YAML en Magnolia CMS Magnolia versiones =6.2.3 tiene un analizador Snake YAML que es vulnerable a ataques de deserialización que pueden permitir a un atacante invocar constructores arbitrarios de Java al importar archivos YAML. Se ha logrado ejecución remota de...

CVE-2026-83803

The error tracking and performance monitoring tool Sentry versions 23.11.0 until 26.7.0 is vulnerable to arbitrary code execution. When the relocation feature is enabled, the application unsafely deserializes a legacy database field during the import of a user-supplied relocation archive. An auth...