136389 matches found
PT-2026-87129
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
CVE-2026-79569: Improper Neutralization of Special Elements used in an SQL Command
MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-78838
A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...
PT-2026-87188
Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refres...
CVE-2026-79569
The Movie_Recommend v1.0.0 software is vulnerable to a SQL injection flaw within the sort parameter at the /loadingmore endpoint. This vulnerability exists because of improper neutralization of special elements used in an SQL command, which allows an attacker to execute a crafted SQL statement to...
EUVD-2026-72959
MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
PT-2026-87069
A reflected cross-site scripting XSS vulnerability in the grid datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...
PT-2026-86985
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli query of the file /pages/us searchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...
CVE-2026-76931: Improper Neutralization of Input During Web Page Generation
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...
PT-2026-87144
mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
PT-2026-87165
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A security issue in the aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks. This occurs when Atlas Search feature...
CVE-2026-78838
A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...
CVE-2026-78838
AppNitro MachForm v30 is vulnerable to a reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by injecting a crafted payload into the filter[filters][0][field] parameter. The vul...
EUVD-2026-72909
L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
PT-2026-87111
Name of the Vulnerable Software and Affected Versions L-ONE version 1.0.0 Description Multiple SQL injection flaws exist in the '/attachment/getBusinessUploadList' endpoint. An attacker can use crafted SQL statements through the busid, id, and taskid parameters to access sensitive database...
CVE-2026-78837
AppNitro MachForm v30 is vulnerable to a remote SQL injection vulnerability within the ap_form_{id} parameter. An unauthenticated attacker can exploit the filter[filters][0][field] parameter in grid_datasource.php to execute crafted SQL statements. This flaw allows for the enumeration of valid co...
CVE-2026-77654: Incorrect Privilege Assignment
Improper Privilege Management vulnerability in Horizon Security Analyzer formerly AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation and Parameter Injection. A local user with access to the command line may escalate their privileges by abusing the parameters of a command that ...
PT-2026-87033
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...
PT-2026-88292
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/us edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used...
ROS-20260908-73-0110
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the lack of measures taken to neutralize special elements during the processing of the unsafegitcloneoptions parameter. Exploiting this vulnerability could allow a remote attacker to execute...