40353 matches found
WordPress plugin VI: Include Post By 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
CVE-2026-1314 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sendpostpagesjson function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticat...
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Summary The conditions filter webhook at libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts line 261 sends POST requests to user-configured URLs using raw axios.post with no SSRF validation. The HTTP Request workflow step in the same codebase correctly uses...
CVE-2026-35196
creationtimestamp| type| source ---|---|--- 2026-04-14 23:22:29+00:00| published-proof-of-concept| Telegram/70ang71mEb6lYSNq2VZHiuuV7i7KfipPcLMkKoGk9-znXQ 2026-04-15 12:08:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjjudrmv7g2u...
CVE-2026-41060
creationtimestamp| type| source ---|---|--- 2026-04-14 23:22:01+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-j432-4w3j-3w8j 2026-04-21 23:22:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk24rzao262t 2026-04-22 01:19:03+00:00| seen|...
CVE-2026-27282
creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:52+00:00| seen| Telegram/jHpVmdM968c9lFQ4KStSRALTqvtLmQ8NC1zLLnKyLbbys0E 2026-04-15 01:56:06+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjis4gfiax2a 2026-04-15 12:08:47+00:00| seen|...
CVE-2026-24893
creationtimestamp| type| source ---|---|--- 2026-04-14 23:21:40+00:00| published-proof-of-concept| Telegram/vFalP9cCg-kFoPrSdHM4ZH4qnLHRdngXJCuq8FbW2RkF4k 2026-04-15 14:09:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjk34nm6dl24 2026-04-28 18:07:07+00:00| seen|...
CVE-2026-35034 Jellyfin: Potential Application DoS from excessively large SyncPlay group names
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint POST /SyncPlay/New, where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By...
CVE-2026-35034
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint POST /SyncPlay/New, where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By...
CVE-2026-35034
CVE-2026-35034 affects Jellyfin before 10.11.7, where an authenticated user can abuse the SyncPlay group creation endpoint (POST /SyncPlay/New) due to insufficient input validation. By sending large payloads (with arbitrary group IDs), an attacker can cause high memory usage and lock out other cl...
CVE-2026-35034
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint POST /SyncPlay/New, where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By...
CVE-2026-27313
creationtimestamp| type| source ---|---|--- 2026-04-14 21:25:42+00:00| published-proof-of-concept| Telegram/YBv3RW-vRVGMDDlTI6JsAJBRTWorFJbZdjQQujfRdi3MBhU 2026-04-15 14:18:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjk3ltl55n2f 2026-06-11 14:37:06+00:00| seen|...
CVE-2026-34161
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...
CVE-2026-34161 Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...
CVE-2026-34161
Technical details are not publicly available in the provided connected documents. Monitor for updates from Chamilo LMS advisory and subsequent CVE details.
CVE-2026-34161
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...
EUVD-2026-22714
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...
CVE-2026-34623
creationtimestamp| type| source ---|---|--- 2026-04-14 20:28:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mji7tdynvb2m 2026-04-15 02:35:49+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mjiudgvh662q...
CVE-2026-27312
creationtimestamp| type| source ---|---|--- 2026-04-14 20:27:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mji7qv3ttr2s 2026-04-14 21:25:42+00:00| published-proof-of-concept| Telegram/YBv3RW-vRVGMDDlTI6JsAJBRTWorFJbZdjQQujfRdi3MBhU 2026-04-16 02:07:07+00:00| seen|...