hsweb4 路径遍历漏洞

hsweb4 is an open-source full-responsive backend management framework based on Spring Boot 2. Versions of hsweb4 prior to 5.0.1 contained a path traversal vulnerability. This vulnerability stemmed from improper handling of the parameter filename in the file upload component’s code, located at...

SourceCodester Onlne Examination & Learning Management System、Syllabus-aligned Learning Management and Examination System 信任管理问题漏洞

SourceCodester Online Examination & Learning Management System is an open-source online examination and learning management system developed by SourceCodester. Version 1.0 of the SourceCodester Online Examination & Learning Management System and Syllabus-aligned Learning Management and Examinatio...

The vulnerability of the Next.js web application development software platform, related to bypassing authentication by using an alternative path or channel, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Next.js web application development software platform relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Briefcase feature in the Zimbra Collaboration Suite email management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the Briefcase feature in the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the `tunnel.allowNgrokFreeTierLoopbackBypass` parameter. This vulnerability is exploited by an AI agent named OpenClaw (previously known as ClawdBot or MoltBot), allowing attackers to compromise the integrity and accessibility of protected information.

The vulnerability of the tunnel.allowNgrokFreeTierLoopbackBypass parameter is related to the AI agent OpenClaw previously ClawdBot or MoltBot. This vulnerability stems from the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to...

The vulnerability of the OAuth authorization protocol implemented by the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) allows a attacker to perform a CSRF attack.

The vulnerability of the OAuth authorization protocol implementation of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

PT-2026-47311

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read resource of the file src/mysql mcp server/server.py of the component mysql URI Handler. This manipulation of the argument uri str causes sql injection. Remote exploitation of t...

Everbrite BeikeShop 注入漏洞

Everbrite BeikeShop is an e-commerce system developed by China Everbright Corporation. Versions of Everbrite BeikeShop prior to 1.6.0.22 contained a SQL injection vulnerability. This vulnerability stemmed from improper handling of parameters with the value “settings.value” in the unknown function...

Student-Management-System 注入漏洞

Student-Management-System is an open-source student information management system developed by Cyber-III. There is a vulnerability in Student-Management-System, which stems from improper handling of the parameter “nic” in the getStatus function of the controllers/GradeController.php file at the...

PT-2026-47269

A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/search staff for deletion.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed t...

PT-2026-47439

Name of the Vulnerable Software and Affected Versions CodeAstro Payroll System version 1.0 Description A remote SQL injection is possible due to the manipulation of the rate/salary rate argument within an unknown function of the '/home salary.php' file. SQL injection is a technique where an...

The vulnerability of the Zimbra Collaboration Suite’s email management system, related to incorrect restrictions on XML links to external objects, allows attackers to carry out XXE attacks.

The vulnerability of the Zimbra Collaboration Suite email management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

CVE-2026-11469 jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery

A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to...

CVE-2026-11469 jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery

A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to...

CVE-2026-11466

A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collectionrouter.py. This manipulation of the argument kwargs causes improper access controls. Remote exploitation of the attack is possible. Th...

CVE-2026-11467

CVE-2026-11467 affects jishenghua jshERP up to 3.6. The vulnerability is in the function addAccountHeadAndDetail of AccountHeadService.java (path: jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java). The root cause is manipulation of the argument fileName, enabling path travers...

CVE-2026-11467 jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal

A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the...

CVE-2026-11466 zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control

A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collectionrouter.py. This manipulation of the argument kwargs causes improper access controls. Remote exploitation of the attack is possible. Th...

CVE-2026-11466

CVE-2026-11466 affects the zilliztech deep-searcher up to version 0.0.2. The issue is in deepsearcher/agent/collection_router.py (function CollectionRouter.invoke ), where argument kwargs manipulation leads to improper access controls. This enables remote exploitation ; the exploit is publicly av...

CVE-2026-11465 songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error

A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotel...