12057 matches found
GHSA-W27M-RMMF-G5W4 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the paneladmins.ip column via the Admins.add or Admins.update endpoint. The payload executes as a UNION-based SQL injection the next time...
CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...
CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...
CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...
CVE-2026-44472
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...
CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...
CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...
CVE-2026-44472
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...
CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...
EUVD-2026-61069
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...
SUSE CVE-2026-72046
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...
WordPress The School Management plugin <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter vulnerability
Authenticated Custom+ SQL Injection via 'order0dir' Parameter vulnerability discovered by j4ck13ch4n in WordPress Plugin The School Management – Education & Learning Management versions = 5.4...
CVE-2026-28567
Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...
EUVD-2026-60892
Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...
CVE-2026-28567
Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...
CVE-2026-28567
The WordPress WP Sort Order plugin (versions ≤ 1.3.5) has an unauthenticated broken access control flaw, exploitable over the network with no credentials, exposing sensitive data (CVSS 7.5 HIGH). CISA confirms no active exploitation; upgrade to a patched version. Details at patchstack.com/databas...
CVE-2026-28567 WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...
CVE-2026-28567 WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...
WordPress Slider Hero with Video Background, Animation plugin <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) vulnerability
Authenticated Administrator+ SQL Injection via 'description' Slide Field Second-Order via Duplicate vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Slider Hero versions = 9.1.7...
