12300 matches found
CVE-2026-82969: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before...
Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution
Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...
ROOT-APP-NPM-CVE-2024-21534 CVE-2024-21534 in jsonpath-plus - Patched by Root
Root has patched CVE-2024-21534 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...
EUVD-2026-86509
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...
CVE-2026-97730
A Local File Inclusion (LFI) vulnerability exists in Netgate pfSense Plus before version 26.07 and pfSense CE before version 2.9.0. The flaw resides in the Dashboard (index.php) widget sequence data handling. An authenticated attacker with permissions to modify Dashboard settings and write files ...
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...
Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution
Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...
Zoho ManageEngine ServiceDesk Plus - Authentication Bypass
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. id: CVE-2021-37415 info: name: Zoho ManageEngine ServiceDesk Plus - Authentication Bypass author: daffainfo,jjcho severity: critical description: | Zoho...
PT-2026-99002
NGINX Plus and NGINX Open Source have a vulnerability in the ngx http v3 module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner...
ManageEngine ADSelfService Plus < Build 7001 RCE (CVE-2026-74849)
According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 7001. It is, therefore, affected by a remote code execution vulnerability: - Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a...
PT-2026-99001
NGINX Plus and NGINX Open Source have a vulnerability in the ngx http v3 module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner...
CVE-2026-97730: Path Traversal: '../filedir'
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...
WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 6.5.1...
CVE-2026-93774
Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...
EUVD-2026-85468
Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...
CVE-2026-93774
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin, affecting versions