34116 matches found
vulnerability-scanner
vulnerability-scanne...
PYSEC-2026-2177
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...
FreePBX API operating system command injection vulnerability
FreePBX API is an open-source plugin developed by FreePBX. Versions of the FreePBX API module prior to 17.0.8 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the GraphQL mutation input fields in the initiateGqlAPIProcess function being pass...
WWBN A Video Path Traversal Vulnerability
WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained a path traversal vulnerability. This vulnerability stemmed from the directory traversal fix in objects/aVideoEncoderReceiveImage.json.php, which only checked the U...
CVE-2026-27937: Improper Neutralization of Input During Web Page Generation
October is a Content Management System CMS and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting XSS vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and...
CVE-2025-70420
Based on connected sources, CVE-2025-70420 concerns Genesys Latitude v25.1.0.420 where an authenticated attacker can execute arbitrary SQL queries due to unsanitized user input concatenated into SQL statements. The affected component is Genesys Latitude, version 25.1.0.420; root cause is input un...
PT-2026-34207
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier Description A directory traversal flaw exists where a security check in 'objects/aVideoEncoderReceiveImage.json.php' only validates the URL path component for traversal sequences. However, the try get...
WordPress plugin CMS for motorcycle workshops: SQL injection vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. The WordPre...
PT-2026-34003
Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.14 October versions prior to 4.1.10 Description A flaw in the Twig sandbox security policy allows database write operations when cms.safe mode is enabled. Backend users with Developer permissions can use Twig...
PT-2026-48300
Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user can cause a server crash or the return of incorrect results by creating documents that interfere with internal metadata processing during query execution. This issue is...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013335)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013335 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: Fix oops when removing custom query handlers When removing custom query handlers, the...
PT-2026-34004
October is a Content Management System CMS and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting XSS vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and...
CVE-2026-3317: Improper Neutralization of Input During Web Page Generation
Reflected Cross-Site Scripting XSS vulnerability in Navigate Content Management System. The vulnerability is present in the '/blog' endpoint because user input is not properly sanitized through designed query parameters. This results in unsafe HTML rendering, which could allow a remote attacker t...
CVE-2026-41456: Improper Neutralization of Input During Web Page Generation
Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit...
Genesys Latitude security vulnerabilities
Genesys Latitude is a debt collection and account management platform developed by Genesys Corporation. Version 25.1.0.420 of Genesys Latitude contains a security vulnerability. This vulnerability arises from the direct concatenation of user input into SQL statements without proper cleaning, whic...
October Cross-site Scripting Vulnerabilities
October is an open-source content management system CMS and network platform developed by October. Versions prior to October 3.7.16 and 4.1.16 contained a cross-site scripting vulnerability. This vulnerability stemmed from insufficient escaping of query parameters during the rendering of the...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-010699)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010699 advisory. An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap- based buffer overflow in setntacldacl, related to use of...
CVE-2026-35588
Glances 4.5.4 fixes a CQL injection in the Cassandra export module. Before 4.5.4, glances_cassandra/init .py interpolates keyspace, table, and replication_factor into CQL without validation, allowing a user with write access to glances.conf to redirect all monitoring data to an attacker-controlle...
CVE-2026-35588 Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...