21610 matches found
PT-2026-86162
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User Model::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...
PT-2026-85544
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg read file through FROM-clause syntax to read arbitrary files despite restricted-mode...
PT-2026-85674
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a...
GHSA-CXVF-GVFQ-36W2 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Summary Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom projec...
CVE-2026-84766
Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...
EUVD-2026-70561
Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...
CVE-2026-84766
An unauthenticated bypass vulnerability exists in the FluentBooking Pro WordPress plugin in versions 2.2.1 and below , as reported by Patchstack. The CVSS 3.1 score is 5.9 (Medium) , with a network attack vector, high complexity, no privileges required, and a high integrity impact but no confiden...
CVE-2026-84766 WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...
CVE-2026-84766 WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...
WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentBooking Pro versions = 2.2.1...
WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Shared Files Pro versions 1.7.70...
ManageEngine Password Manager Pro < Build 13235 SQLi (CVE-2026-14828)
According to its self-reported build number, the ManageEngine Password Manager Pro application running on the remote host is prior to build 13235. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious...
PT-2026-85106
Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...
@docyrus/ui-pro-ai-assistant (>=0.8.4, <=0.14.9) potentially affected by CVE-2026-65842 via @platejs/docx-io (53.1.0)
@platejs/docx-io NPM version 53.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/docx-io and may be impacted: - @docyrus/ui-pro-ai-assistant =0.8.4, =0.14.9 Source cves: CVE-2026-65842 Source advisory: OSV:GHSA-4Q39-2JHR-7QX8...
Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
On August 19th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with more than 6,000,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including...
CVE-2026-14828
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...
CVE-2026-14828
Zohocorp ManageEngine products—Password Manager Pro (before 13235), PAM360 (before 8561), and Access Manager Plus (before 4405)—are vulnerable to an authenticated SQL Injection flaw. The CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploit...
EUVD-2026-69888
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...
CVE-2026-14828
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...
CVE-2026-14828
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...