Lucene search
+L

108062 matches found

Cvelist
Cvelist
added 5 days ago31 views

CVE-2026-47668 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

10CVSS0.04339EPSS
SaveExploits1References3
Vulnrichment
Vulnrichment
added 5 days ago8 views

CVE-2026-47668 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

10CVSS6.2AI score0.04339EPSS
SaveExploits1References3
CVE
CVE
added 5 days ago60 views

CVE-2026-47668

DbGate (dbgate-serve) up to v7.1.8 is affected by a critical RCE in the JSON Script Runner. User-controlled fields (functionName, and also variableName in assign commands) are concatenated into dynamically generated JavaScript and executed in a forked Node.js process, enabling arbitrary command e...

10CVSS6.2AI score0.04339EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 5 days ago6 views

CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

10CVSS6.2AI score0.04339EPSS
SaveExploits1References4Affected Software1
OSV
OSV
added 5 days ago11 views

CVE-2026-47668 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

10CVSS6.2AI score0.04339EPSS
SaveExploits1References5
Vulnrichment
Vulnrichment
added 5 days ago9 views

CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...

8.7CVSS5.5AI score0.00353EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago5 views

CVE-2026-48539

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

5.4CVSS0.00138EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago6 views

CVE-2026-48535

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

5.4CVSS0.00138EPSS
SaveExploits0References2
EUVD
EUVD
added 5 days ago6 views

EUVD-2026-48298

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

5.4CVSS5AI score0.00138EPSS
SaveExploits0References2
EUVD
EUVD
added 5 days ago6 views

EUVD-2026-48290

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The...

5.4CVSS5.1AI score0.00138EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago7 views

CVE-2026-65899

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...

6.1CVSS0.00215EPSS
SaveExploits0References3
OSV
OSV
added 5 days ago8 views

CVE-2026-65899 DOMPurify before 3.4.9 Trusted Types Policy State Contamination

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...

5.1CVSS5.6AI score0.00215EPSS
SaveExploits0References5
CVE
CVE
added 5 days ago15 views

CVE-2026-65899

The CVE affects DOMPurify 3.0.0 through 3.4.8, where clearConfig() does not reset the retained TRUSTED_TYPES_POLICY. This allows a DOMPurify instance reused across trust boundaries to remain bound to a previously supplied policy, so a later caller requesting RETURN_TRUSTED_TYPE output may receive...

6.1CVSS5.6AI score0.00215EPSS
SaveExploits0References3
OSV
OSV
added 5 days ago4 views

PYSEC-2026-3471 OpenStack Ironic allows Boot Script Injection

OpenStack Ironic through 35.0.x allows Boot Script Injection...

5.8CVSS5.2AI score0.00262EPSS
SaveExploits0References8
Cvelist
Cvelist
added 5 days ago30 views

CVE-2026-15394 Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00193EPSS
SaveExploits0References5
EUVD
EUVD
added 5 days ago7 views

EUVD-2026-47906

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.6AI score0.00193EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 5 days ago6 views

CVE-2026-14481

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it...

6.4CVSS5.6AI score0.00307EPSS
SaveExploits0References11
NVD
NVD
added 5 days ago7 views

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

6.1CVSS0.00149EPSS
SaveExploits0References1
EUVD
EUVD
added 5 days ago6 views

EUVD-2026-47936

The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushrnotificationtitle' and 'webpushrnotificationbody' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the savesendnotificationflag...

6.4CVSS5.5AI score0.00193EPSS
SaveExploits0References5
NVD
NVD
added 6 days ago7 views

CVE-2026-64796

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

9.8CVSS0.00151EPSS
SaveExploits0References1
Rows per page
Query Builder