31506 matches found
Online Event Booking and Reservation System 2.3.0 - SQL Injection
Online Event Booking and Reservation System 2.3.0 contains a SQL injection vulnerability in event-management/views. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...
Academy Learning Management System <5.9.1 - Cross-Site Scripting
Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...
My Calendar WordPress Plugin - Information Disclosure
My Calendar WordPress plugin = 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parsestr in mcajaxmcjsaction endpoint, letting unauthenticated attackers access or crash sites via switchtoblog, exploit requires WordPress Multisite or Single Site setup. id:...
Leantime < 2.4 - Authenticated SQL Injection
Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...
WordPress JobWP Plugin <= 2.3.9 - SQL Injection
The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...
DVHMA
DVHMA Damn Vulnerable Hybrid Mobile App（DVHMA）是一款 故意 包含漏洞的混合移动应用（适用于 Android）。其目的是让安全专业人员能够合法地测试他们的工具和技术，帮助开发者更好地理解在安全开发混合移动应用时的常见陷阱。 动机与范围 开发此应用旨在研究开发混合应用（例如使用 Apache Cordova 或 SAP Kapsel）时的安全隐患。目前，主要焦点是深入理解利用 JavaScript 到 Java 桥接的注入漏洞。 安装 前提条件 我们假设您已安装： Android...
safetext
safetext Este no es un producto con soporte oficial de Google. Bibliotecas seguras por construcción para producir formatos como YAML, para reemplazar bibliotecas que no conocen la sintaxis, como text/template y sprintf, que corren el riesgo de sufrir vulnerabilidades de inyección. Caso de uso de...
CVE-2026-33937
Esta publicación es un artículo de investigación publicado por EQSTLab. PoC de referencia: dinhvaren/cve-2026-33937 CVE-2026-33937 ★ CVE-2026-33937 PoC de inyección de AST y ejecución remota de código en Handlebars.js ★ https://github.com/user-attachments/assets/99e383e7-e71f-4e10-8c62-f50abff8b4...
CVE-2026-93527 WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability
Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...
MOVEit Transfer - SQL Injection
In Progress MOVEit Transfer before 2021.0.8 13.0.8, 2021.1.6 13.1.6, 2022.0.6 14.0.6, 2022.1.7 14.1.7, and 2023.0.3 15.0.3, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit...
Astra Linux – Vulnerability in Twisted
Twisted is an event-based framework for internet applications. It was introduced with version 0.9.4. At that time, when the host header did not match a configured host using twisted.web.vhost.NameVirtualHost, a “NoResource” resource would be returned. This caused the Host header to be rendered...
CVE-2026-87572
A flaw was found in the DevTools component of Chromium. A remote attacker, after compromising the renderer process, could exploit an injection vulnerability by crafting a malicious HTML page. This could potentially lead to the execution of arbitrary code outside the sandbox, allowing the attacker...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvirt (UTSA-2026-106765)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106765 advisory. An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attribut...
N-able N-central Static Code Injection Vulnerability
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution...
rConfig 3.9 - SQL Injection
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. id: CVE-2020-10220 info: name: rConfig 3.9 - SQL Injection author: ritikchaddha,theamanrawat severity: critical description: | An issue was discovered i...
CVE-2026-45570
A flaw was found in go-git, a library used for Git operations. The component responsible for secure shell SSH communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to manipulate the command executed on the server by including a...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-redcarpet (UTSA-2026-032342)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032342 advisory. Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting...
CVE-2026-79087
A flaw was found in Chromium. This injection vulnerability, specifically within Chrome Tabs, allows a remote attacker to potentially bypass system access restrictions. The exploitation occurs when a user interacts with a specially crafted HTML page, leading to unauthorized access within the syste...
CVE-2026-76148
CorvusSKK is affected by a code injection vulnerability that may allow an attacker to achieve arbitrary code execution on the target system. The attack vector is local, requires user interaction, and needs no prior privileges, with high impact on confidentiality, integrity, and availability (CVSS...
