CVE-2020-28414

CVE-2020-28414 제안된 설명 TranzWare Payment Gateway 3.1.12.3.2에 반사형 교차 사이트 스크립팅 XSS 취약점이 존재합니다. 원격에서 인증되지 않은 공격자가 조작된 URL을 통해 임의의 HTML 코드를 실행할 수 있습니다. 취약점 유형 교차 사이트 스크립팅 XSS 제품 공급업체 TranzWare 영향받는 제품 코드 베이스 Payment Gateway 3.1.12.3.2. 공격 유형 원격 코드 실행 영향 true 공급업체가 취약점을 확인 또는 인정했습니까? true 참고...

CVE-2022-4896

CVE-2022-4896 CVE-2022-4896에 대한 PoC 및 익스플로잇 "Control de Ciber"는 PC방 관리 소프트웨어입니다. 1.650 이전 버전에는 여러 가지 서비스 거부DoS 취약점이 존재합니다. 인증되지 않은 원격 공격자는 특별히 조작된 요청을 전송하여 서비스 충돌을 유발할 수 있습니다. Spooler DoS Spooler 익스플로잇 PNTMedidas DoS PNTMedidas 익스플로잇 Pedir DoS Pedir 익스플로잇 HayDiscoA DoS HayDiscoA 익스플로잇...

106362522

106362522 최근 마이크로소프트가 해커 공격을 받은 Exchange Server 취약점을 패치했다고 발표한 것과 관련해, 대만 DEVCORE는 이미 1월 5일에 보안 취약점을 발견하고 마이크로소프트에 이 취약점을 「CVE-2021-26855」 및 「CVE-2021-27065」로 명명된 제로데이 취약점으로 신고했으며, 동시에 이 취약점을 「ProxyLogon」이라고 부른다고 밝혔습니다. 이번에 공개된 「ProxyLogon」 취약점은 인증 없이 사용할 수 있는 원격 코드 실행Pre-Auth Remote Code...

EUVD-2026-57757

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jul 2026 - Includes Oracle July 2026 CPU plus four additional vulnerabilities for Rational Software Architect Designer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition,Versions 8 , Java 17 and Java 21 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM SDK, Java Technolo...

CVE-2026-102374 GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject...

EUVD-2026-88362

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-101333 Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

CVE-2026-73640 Time-based SQL Injection in Dayforce Payroll

Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based...

CVE-2026-93000 SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...

CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller

Citrix Netscaler CVE-2026-8452 RCE Vulnerability !Banner...

WordPress Mailchimp for WooCommerce plugin < 6.3 - Unauthenticated Customer Email and Cart Disclosure vulnerability

Unauthenticated Customer Email and Cart Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin MailChimp For WooCommerce versions 6.3...

CVE-2026-86609

The Download Manager WordPress plugin (versions before 7.5.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape data submitted via the email-locked download subscription form before it is outputted on an admin page. This flaw allows unauthe...

CVE-2026-100622 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

CVE-2026-89237

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

EUVD-2026-87542

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

EUVD-2026-87534

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

EUVD-2026-87536

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...