CVE-2026-94383

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

WordPress Pochipp plugin <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter vulnerability

Reflected Cross-Site Scripting via 'keyword' Parameter vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Pochipp versions = 1.20.2...

CVE-2026-94138 Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...

PT-2026-96125

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross-site Scripting XSS occurs in the 'index.php' file. Remote unauthenticated attackers can exploit this by providing an arbitrarily named URL parameter key that contains a URL-encoded XSS payload...

EUVD-2026-83990

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

CVE-2026-94138: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...

CVE-2026-36468: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "...

ROS-20260921-73-0109

The vulnerability of the checkpassword script in the DCE/RPC SAMR server of the Samba networking software package is related to the failure to eliminate special elements during the processing of the parameter %u. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by...

CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

CVE-2026-94139: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...

PT-2026-96298

Name of the Vulnerable Software and Affected Versions Gladys Assistant versions prior to 5.1.0 Description An issue exists where unauthenticated remote attackers can obtain valid password reset tokens for any account. This occurs due to a lack of server-side validation of the client-supplied orig...

CVE-2026-36468

A Cross-site Scripting (XSS) vulnerability exists in the index.php component of CuteNews v.2.1.2 . The root cause is the improper neutralization of input during web page generation , which allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key. If this key contai...

ROS-20260921-73-0016

The vulnerability of the printing subsystem in Samba networking-enabled programs is related to the lack of measures taken to neutralize special elements during the processing of the %J parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Exploit for SQL Injection in Zoneminder

ZoneMinder 1.29/1.30 SQLi to RCE Exploit A ready-to-run Pytho...

EUVD-2026-83767

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

NextRecon

NextRecon NextRecon is a simple Python-based reconnaissance tool designed for bug bounty hunters, security researchers, and penetration testers. It performs passive recon by collecting archived URLs from the Wayback Machine and fetching leaked credentials from the BreachCollection API. It also...

CVE-2026-94032 itsourcecode Leave Management System index.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-94015 SourceCodester Drug Recommendation System edit_user.php sql injection

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drugrecommender/Admin/edituser.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available an...