40375 matches found
CVE-2026-5795
creationtimestamp| type| source ---|---|--- 2026-04-08 14:57:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miykitb4ng2t 2026-04-08 15:16:41+00:00| seen| Telegram/Jgs5105KRNeeN6Me9oFeQT01tz9bvpQqKtTaGf0YvrxH7I 2026-04-20 11:54:00+00:00| seen|...
CVE-2026-1865
creationtimestamp| type| source ---|---|--- 2026-04-08 14:37:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyjg536k62t...
CVE-2026-28264
creationtimestamp| type| source ---|---|--- 2026-04-08 14:35:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyjbaoxui2z 2026-04-09 02:29:14+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mizr665myz26...
CVE-2026-39393 Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check cache'settings' combined with .env file existence to block...
CVE-2026-39393
CVE-2026-39393 affects the ci4ms CodeIgniter 4-based CMS skeleton. Before 0.31.4.0, the install route guard uses a volatile cache check (cache('settings')) and .env existence to block setup access; if the database is temporarily unreachable during a cache miss, the guard can fail open, allowing a...
CVE-2026-39393 Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check cache'settings' combined with .env file existence to block...
CVE-2026-39391 CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the blacklist ban note parameter in UserController::ajaxblackListpost is stored in the database without sanitization and rendered into a...
CVE-2026-32540
creationtimestamp| type| source ---|---|--- 2026-04-08 13:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miyfmzazry2h...
CVE-2026-39412
creationtimestamp| type| source ---|---|--- 2026-04-08 13:25:48+00:00| published-proof-of-concept| https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv 2026-04-08 22:26:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizdmcxlbw2i...
CVE-2026-0232
creationtimestamp| type| source ---|---|--- 2026-04-08 13:04:52+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/palo-alto-networks-security-advisory-av26-331 2026-04-08 19:03:32+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3miyyb76lmf2p 2026-04-13 10:57:52+00:00| seen|...
EUVD-2026-20453
WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
CVE-2026-3396
WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
CVE-2026-3396
The CVE-2026-3396 entry concerns WCAPF – WooCommerce Ajax Product Filter plugin, affected up to version 4.2.3. The vulnerability is an unauthenticated time-based SQL Injection via the 'post-author' parameter, caused by insufficient escaping of user input and insufficient use of prepared statement...
CVE-2026-3396 WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
CVE-2026-3396
WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
CVE-2026-39707
creationtimestamp| type| source ---|---|--- 2026-04-08 11:01:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy5e4f35z2i...
CVE-2026-4300
creationtimestamp| type| source ---|---|--- 2026-04-08 10:51:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy4s7jhqh23...
CVE-2026-39715
creationtimestamp| type| source ---|---|--- 2026-04-08 10:41:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miy4ackqvb2i...