36570 matches found
CVE-2026-0816 All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter
The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'deleteid' parameter in all versions up to, and including, 1.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-0816
The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'deleteid' parameter in all versions up to, and including, 1.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-0816 All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter
The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'deleteid' parameter in all versions up to, and including, 1.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
EUVD-2026-5411
The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'checkfortisnotifyresponse' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order...
PT-2026-6018
Name of the Vulnerable Software and Affected Versions Fortis for WooCommerce versions up to and including 1.2.0 Description The Fortis for WooCommerce plugin for WordPress has an authorization bypass issue because of an incorrect nonce check within the check fortis notify response function. This...
Linux kernel 安全漏洞
The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from a spelling error in the frequency notifications. This vulnerability may lead to null pointer...
PT-2026-6022
Name of the Vulnerable Software and Affected Versions All push notification for WP versions up to and including 1.5.3 Description The All push notification for WP plugin for WordPress is susceptible to time-based SQL Injection via the delete id parameter. This is due to inadequate escaping of...
CVE-2025-6397
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS. This issue affects Website Software: through 03022026. NOTE: The vendor was contacted early about this disclosure but did...
CVE-2025-6593
CVE-2025-6593 affects Wikimedia Foundation MediaWiki. A remote attacker could entice a user to interact with malicious content in includes/user/User.Php, potentially leading to disclosure of limited sensitive information. Affected versions include MediaWiki 1.27.0 before 1.39.13, 1.42.7–1.43.2, a...
CVE-2025-6593 "{{SITENAME}} registered email address has been changed" email sent to unverified email addresses
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0...
Server-side Request Forgery (SSRF)
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via insufficient validation of the backchannelclientnotificationendpoint,...
CVE-2026-1518
CVE-2026-1518 is marked as rejected in the public CVE feed. Connected documents, however, describe a Keycloak SSRF issue via the CIBA backchannel notification endpoint . The vulnerability arises from insufficient validation of the client-configured backchannel_notification_endpoint during client ...
📄 MaNGOSWeb 4.0.6 Multi-Exploit Framework
A comprehensive penetration testing tool designed to identify and exploit multiple critical vulnerabilities in MangosWeb 4 version 4.0.6, a World of Warcraft emulator web interface. These include SQL injection, XML injection, file write vulnerabilities, and more...
Keycloak 代码问题漏洞
Keycloak is an open-source identity and access management solution developed by Keycloak itself. Keycloak has code-related vulnerabilities; these vulnerabilities stem from insufficient backend notification endpoint validation by the CIBA function regarding client configurations. This may lead to...
PT-2026-5623
A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services...
BIT-GITEA-2026-20800 Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...
CVE-2026-1598
CVE-2026-1598 affects Bdtask Bhojon All-In-One Restaurant Management System (up to 20260116). The vulnerability lies in the User Information Module, specifically the /dashboard/home/profile function, where manipulating the fullname argument triggers cross-site scripting. The issue is exploitable ...
CVE-2025-59899
Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting XSS vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user...
ROS-20260129-73-0053
A vulnerability in the Notification interface of Mozilla Firefox, Firefox ESR and Thunderbird email client is related to an operation exceeding buffer boundaries in memory when processing DOM objects. Exploitation of the vulnerability could allow an attacker acting remotely to escalate his...