275090 matches found
CVE-2026-14498
Affected software: Query Wrangler plugin for WordPress (tested up to version 1.5.57). Vulnerability: Remote Code Execution via the options parameter in the wp_ajax_qw_form_ajax handler. Root cause is a missing capability check and nonce verification, with unsanitized attacker-controlled options b...
CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...
EUVD-2026-59852
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...
CVE-2026-14498
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...
SJ-GPS-PRO-F11-Vulnerability
Independent vulnerability research on the SJRC F11 series consum...
PT-2026-73085
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp ajax qw form ajax handler, combined with unsanitized...
PT-2026-73095
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...
PT-2026-73096
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create link item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...
PT-2026-73086
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on...
CVE-2026-73043
SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...
CVE-2026-73043 SiYuan before v3.7.4 Remote Code Execution via Template Calculation
SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...
CVE-2026-73043
SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...
CVE-2026-73043
SiYuan before v3.7.4 has a remote code execution vulnerability in the Template calculation operator. It renders user-authored Go templates and stores output verbatim without sanitization, permitting injection of malicious HTML/JavaScript that executes in the desktop client renderer with Node inte...
CVE-2026-73042 SiYuan before v3.7.4 Remote Code Execution via Menu Metadata
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitra...
CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations
SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...
CVE-2026-55153 vulnerabilities
Vulnerabilities for packages: debezium, hono, airbyte-server-fips, airbyte-platform, airbyte-platform-fips...
MINI-23Q5-H2M8-M4P9
Bulletin has no description...
MINI-CV28-GHF4-WGHC
Bulletin has no description...