CVE-2026-21451

Bagisto’s CMS page editor contains a stored XSS vulnerability in versions prior to 2.3.10. The issue arises because server-side sanitization is insufficient and the UI-level filter can be bypassed by tampering the raw HTTP POST payload, allowing arbitrary JavaScript to be stored and executed when...

CVE-2026-21451 Bagisto has HTML Filter Bypass that Enables Stored XSS

Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting XSS vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize tags, the filtering can be bypassed by manipulating the raw HTTP POST...

CVE-2026-21446

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints /install/api/ are directly accessible and exploitable without any authentication. An attacker can...

Tokyo FM Data Breach: Hacker Claims Over 3 Million Records Stolen

Tokyo FM is investigating claims of a massive data breach involving 3 million records. Learn what information was allegedly taken and how you can stay safe...

CVE-2025-15437 LigeroSmart Environment Variable cross site scripting

A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument REQUESTURI results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could...

[SECURITY] Fedora 43 Update: direwolf-1.8.1-1.fc43

Dire Wolf is a modern software replacement for the old 1980's style TNC built with special hardware. Without any additional software, it can perform as an APRS GPS Tracker, Digipeater, Internet Gateway IGate, APRStt gateway. It can also be used as a virtual TNC for other applications such as...

emlog 安全漏洞

emlog is emlog open source a set of PHP and MySQL based CMS website building system. A security vulnerability exists in version 2.5.23 of emlog, the vulnerability stems from the administrator can set the control item, which may lead to users can not be edited or deleted after posting articles...

PT-2026-1068

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.8.23 Description A flaw exists in PluXml that could allow for remote code execution. The issue is located in the FileCookieJar:: destruct function within the core/admin/medias.php file of the Media Management Module...

PT-2026-1062

Name of the Vulnerable Software and Affected Versions PHPGurukul Online Course Registration versions up to 3.1 Description A flaw exists in PHPGurukul Online Course Registration that allows for unrestricted file uploads. This issue is related to the processing of the /admin/edit-student-profile.p...

PT-2026-1064

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 2.2.0 Description A Server-Side Request Forgery SSRF issue exists in the /api/files/export-content endpoint. The download image to temp function in backend/routers/files.py does not properly validate...

PT-2026-1098

Name of the Vulnerable Software and Affected Versions Qfiling versions prior to 3.13.1 Description A path traversal issue exists in Qfiling that could allow remote attackers to read the contents of unexpected files or system data. Approximately 3257k+ instances are potentially exposed. The...

PT-2026-1065

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions up to 2.2.0 Description A security issue exists in parisneo/lollms that allows any authenticated user to accept or reject friend requests belonging to other users. The respond request function within...

PT-2026-1063

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions through 2.2.0 Description An issue exists in parisneo/lollms that allows unauthenticated users to upload and process files. The /api/files/extract-text endpoint does not require authentication, unlike other file-relate...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2025-873)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-873 advisory. The upstream advisory describes this issue as follows: A memory-related vulnerability in PHP's filter handling system, particularly when processing input with convert.quoted-printable-decode...

CVE-2025-66398

creationtimestamp| type| source ---|---|--- 2026-01-01 17:54:57+00:00| published-proof-of-concept| https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9 2026-01-01 18:21:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbeypj7h5c2p 2026-01-01...

CVE-2025-68620

creationtimestamp| type| source ---|---|--- 2026-01-01 17:54:21+00:00| published-proof-of-concept| https://github.com/SignalK/signalk-server/security/advisories/GHSA-fq56-hvg6-wvm5 2026-01-01 20:01:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbf6bouxuo2u 2026-01-01...

CVE-2025-62078

Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Upload Files During Checkout: from n/a through = 3.0.0...

CVE-2025-15406

The CVE-2025-15406 entry affects PHPGurukul Online Course Registration up to version 3.1, where a flaw in an unknown function leads to missing authorization and enables remote exploitation. The exploit is known to have been published. Public disclosures across multiple feeds corroborate an author...

EUVD-2026-0015

The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'mystickyelementsbulks' function in all versions up to, and including, 2.3.3. This...

CVE-2025-62758

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Funnelforms Funnelforms Free funnelforms-free allows DOM-Based XSS.This issue affects Funnelforms Free: from n/a through = 3.8...