CVE-2026-38569

HireFlow v1.2 is vulnerable to Cross Site Scripting XSS in candidatedetail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add...

VulnCheck KEV: CVE-2019-13396

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the forminclude parameter in an index.php?q=system-handle-form-submit POST request because of an includeonce in systemhandleformsubmit in modules/system/system.module...

Grav 输入验证错误漏洞

Grav is a scalable content management system CMS developed by the Grav open-source community, suitable for use in personal blogs, small content publishing platforms, and single-page product displays. Prior to Grav 2.0.0-beta.2, there was a vulnerability related to input validation errors. This...

HireFlow 安全漏洞

HireFlow is an online interview management platform developed by StratonWebDesigners as a personal developer project. Version 1.2 of HireFlow contains a security vulnerability. This vulnerability stems from the fact that all POST endpoints for state changes do not implement CSRF token verificatio...

CVE-2026-38566

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...

PT-2026-39876

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker MantisBT versions prior to 2.28.2 Description An authorization bypass exists in the private issue monitoring feature. A user with project-level access can send a crafted POST request to the 'bug monitor add.php' endpoint to...

CVE-2026-38566

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...

PT-2026-39654

Name of the Vulnerable Software and Affected Versions HireFlow version 1.2 Description The software fails to implement Cross-Site Request Forgery CSRF token validation on state-changing POST endpoints. This allows an attacker to trick an authenticated user into visiting a malicious page to perfor...

CVE-2026-38569

HireFlow v1.2 is vulnerable to Cross Site Scripting XSS in candidatedetail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add...

CVE-2026-45191

creationtimestamp| type| source ---|---|--- 2026-05-10 23:00:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mljugsrrky2c 2026-05-11 00:01:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mljxsux5g52i...

CVE-2026-45190

creationtimestamp| type| source ---|---|--- 2026-05-10 22:45:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mljtlxkuxu2n 2026-05-10 23:56:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mljxjvtq5l24...

CVE-2026-45179

creationtimestamp| type| source ---|---|--- 2026-05-10 20:31:13+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mljm3gtlwy22 2026-05-10 22:50:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mljtuvxomw2h 2026-05-11 16:39:48+00:00| seen|...

CVE-2026-41872

creationtimestamp| type| source ---|---|--- 2026-05-10 20:00:30+00:00| seen| https://jvn.jp/en/jp/JVN38632731 2026-05-11 10:54:35+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mll4cmsyhu2k 2026-05-12 09:25:00+00:00| seen|...

CVE-2026-41530

creationtimestamp| type| source ---|---|--- 2026-05-10 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN68350834 2026-05-11 07:34:08+00:00| seen| https://bsky.app/profile/eulanov.m.eula.dev.ap.brid.gy/post/3mlkqw7oxmmw2 2026-05-12 09:19:41+00:00| seen|...

CVE-2026-45400

creationtimestamp| type| source ---|---|--- 2026-05-10 19:37:59+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-8w7q-q5jp-jvgx 2026-05-16 08:04:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxevxzuty2t 2026-05-19...

CVE-2026-45398

creationtimestamp| type| source ---|---|--- 2026-05-10 19:36:49+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9 2026-05-16 10:00:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxllyrkbw2g...

CVE-2021-47935

creationtimestamp| type| source ---|---|--- 2026-05-10 17:05:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mljal4247t2q 2026-05-18 09:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mm4lb7gj2p2p...

CVE-2021-47933

creationtimestamp| type| source ---|---|--- 2026-05-10 16:48:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlj7ns3ojt2p...

EUVD-2022-55972

WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the posttitle parameter. Attackers with editor privileges can inject JavaScript payloads through the...

EUVD-2022-55979

WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the postid parameter. Attackers can craft URLs to the grunion-form-view.php endpoint with script payloads in the postid parameter ...