Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

307 matches found

EUVD
EUVD•added 2026/03/05 9:30 a.m.•16 views

EUVD-2026-9811

The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'metakey' parameter in the contentclone function in all versions up to, and including, 6.3. This is due to insufficient escaping on the user-supplied metakey value and insufficient preparation on the existing SQL...

6.5CVSS6AI score0.00249EPSS
SaveExploits0References5
NVD
NVD•added 2026/03/05 8:15 a.m.•23 views

CVE-2026-2893

The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'metakey' parameter in the contentclone function in all versions up to, and including, 6.3. This is due to insufficient escaping on the user-supplied metakey value and insufficient preparation on the existing SQL...

6.5CVSS0.00249EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB•added 2026/03/05 7:30 a.m.•9 views

CVE-2026-2893

The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'metakey' parameter in the contentclone function in all versions up to, and including, 6.3. This is due to insufficient escaping on the user-supplied metakey value and insufficient preparation on the existing SQL...

6.5CVSS6AI score0.00249EPSS
SaveExploits0References5
CVE
CVE•added 2026/03/05 7:30 a.m.•35 views

CVE-2026-2893

CVE-2026-2893 : The Page and Post Clone plugin for WordPress is vulnerable to a SQL Injection via the meta_key parameter in the content_clone() function in all versions up to and including 6.3. The issue stems from insufficient escaping of the user-supplied meta_key value and inadequate preparati...

6.5CVSS6AI score0.00249EPSS
SaveExploits0References4
Packet Storm
Packet Storm•added 2026/02/26 12:00 a.m.•160 views

📄 Textpattern 4.9.0 Cross Site Scripting

Textpattern version 4.9.0 suffers from a cross site scripting vulnerability. ============================================================================================================================================= | Title : Textpattern 4.9.0 Second-Order XSS via Atom Feed Injection | | Autho...

5AI score
SaveExploits0
RedhatCVE
RedhatCVE•added 2026/02/22 1:25 p.m.•16 views

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

8.8CVSS6.3AI score0.0048EPSS
SaveExploits2References1
GithubExploit
GithubExploit•added 2026/02/21 5:05 p.m.•220 views

Exploit for CVE-2026-27470

CVE-2026-27470 — ZoneMinder Second-Order SQL Injection !CVE...

8.8CVSS6.2AI score0.0048EPSS
SaveExploits2
NVD
NVD•added 2026/02/21 8:16 a.m.•21 views

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

8.8CVSS0.0048EPSS
SaveExploits2References4
OSV
OSV•added 2026/02/21 8:16 a.m.•23 views

UBUNTU-CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

8.8CVSS6.1AI score0.0048EPSS
SaveExploits2References6
Cvelist
Cvelist•added 2026/02/21 8:05 a.m.•35 views

CVE-2026-27470 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

8.8CVSS0.0048EPSS
SaveExploits2References4
CVE
CVE•added 2026/02/21 8:05 a.m.•148 views

CVE-2026-27470

ZoneMinder (versions 1.36.37 and earlier; 1.37.61–1.38.0) contains a second‑order SQL Injection in web/ajax/status.php:getNearEvents(). Although event fields Name and Cause are stored via parameterized queries, they are concatenated into SQL WHERE clauses without escaping, allowing an authenticat...

8.8CVSS6.4AI score0.0048EPSS
SaveExploits2References4Affected Software1
Vulnrichment
Vulnrichment•added 2026/02/21 8:05 a.m.•9 views

CVE-2026-27470 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

8.8CVSS6.2AI score0.0048EPSS
SaveExploits2References4
OSV
OSV•added 2026/02/21 8:05 a.m.•15 views

CVE-2026-27470 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

8.8CVSS6.4AI score
SaveExploits0References6
AlpineLinux
AlpineLinux•added 2026/02/21 8:05 a.m.•40 views

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

8.8CVSS6.4AI score0.0048EPSS
SaveExploits2
RedhatCVE
RedhatCVE•added 2026/02/21 1:31 a.m.•29 views

CVE-2026-26745

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or...

5.3CVSS6.1AI score0.00299EPSS
SaveExploits1References1
CNNVD
CNNVD•added 2026/02/21 12:00 a.m.•20 views

ZoneMinder SQL注入漏洞

ZoneMinder is an open-source video monitoring software system developed by ZoneMinder. This system supports IP, USB, and analog cameras. Versions of ZoneMinder prior to 1.36.37, as well as versions 1.37.61 to 1.38.0, have a SQL injection vulnerability. This vulnerability stems from the...

8.8CVSS6.1AI score0.0048EPSS
SaveExploits2References4
NVD
NVD•added 2026/02/20 5:25 p.m.•24 views

CVE-2026-26745

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or...

5.3CVSS0.00299EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment•added 2026/02/20 12:00 a.m.•7 views

CVE-2026-26745

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or...

6AI score0.00299EPSS
SaveExploits1References2
Cvelist
Cvelist•added 2026/02/20 12:00 a.m.•40 views

CVE-2026-26745

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or...

0.00299EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB•added 2026/02/20 12:00 a.m.•12 views

CVE-2026-26745

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or...

6.1AI score0.00299EPSS
SaveExploits1References3
Rows per page
Query Builder