EUVD-2026-66268

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

CVE-2026-75798 AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...

CVE-2026-5465

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the UpdateProviderCommandHandler failing to validate changes to the externalId field when a Provider Employe...

EUVD-2018-3438

Malware in sbrugna...

EUVD-2018-12588

Malware in sbrugna...

EUVD-2025-30981

Malicious code in bioql PyPI...

CVE-2025-7365

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

DomainMOD cross-site scripting vulnerability (CNVD-2019-07964)

DomainMOD is an open source application for managing your domain names and other Internet assets in a central location. DomainMOD 4.11.01 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the assets/add/ssl-provider-account.php username field...

Default credentials

DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field...

CVE-2018-20010

DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field...

Design/Logic Flaw

DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter...

DomainMod cross-site scripting vulnerability (CNVD-2018-10361)

DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in DomainMod version 4.09.03. A remote attacker can exploit this vulnerability by sending the 'sslpaid' parameter to the...

Ubuntu Update for likewise-open vulnerability USN-964-1

Ubuntu Update for Linux kernel vulnerabilities USN-964-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9641.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for likewise-open vulnerability USN-964-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...