CVE-2026-86867

Cinnamon's Kotaemon (all versions up to and including v0.12.0 ) contains multiple vulnerabilities in its multi-user chat interface due to incorrect authorization and improper access controls . Four handler methods in libs/ktem/ktem/pages/chat/control.py (specifically select_conv, delete_conv, ren...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-85169

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the existing SQL query for the 'log' (Username) parameter. Beca...

CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

WordPress Rename wp-login.php to anything you want plugin <= 2.0.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Rename wp-login.php to anything you want versions = 2.0.1...

PT-2026-97241

Name of the Vulnerable Software and Affected Versions Rename wp-login.php to anything you want versions prior to 2.0.2 Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before...

CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92986

SiYuan before 3.8.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the backlink dock tree , where document titles are rendered as HTML without escaping markup characters. An attacker can set a malicious title via the rename API or crafted notebooks, executing scripts in the Electron...

CVE-2026-92247

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247 synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

EUVD-2026-80091

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247 synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247 synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247

CVE-2026-92247 affects synaptik-cms up to version 1.3.4.4 . The vulnerability resides in the rename function of admin/file-manager.php within the Admin File Manager component, where manipulation of this function leads to unrestricted upload of files. The attack can be initiated remotely but requi...

PT-2026-93264

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-92247: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-18423

Concrete CMS versions 9.0.0 through 9.5.2 contain an Insecure Direct Object Reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity can permanently delete (with no undo) or rename saved search pres...