EUVD-2026-67233

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST'updatekeys', 'array' in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers,...

CVE-2026-81524 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

CVE-2025-60787

CVE-2025-60787 — motionEye Authentifizierte RCE Authentifizierte Command-Injection-PoC für CVE-2025-60787. motionEye v0.43.1b4 und frühere Versionen schreiben benutzergesteuerte Kamera-Konfigurationswerte wie imagefilename ohne ausreichende Bereinigung in die Motion-Konfiguration, was die...

EUVD-2026-67092

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-52658

CVE-2026-52658 — AureusERP Gespeichertes XSS Chatter-Änderungsverfolgung CWE-79 · CVSS 8.7 Hoch · AureusERP ≤ v1.4.0 / master Chatter rendert die Felder oldvalue / newvalue der Änderungsverfolgung als rohes HTML !! !!, keine Bereinigung. Ein authentifizierter Benutzer, der einen Datensatz...

CVE-2026-81676

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-26211

CVE-2026-26211 — XSS persistente in Ekushey Project Manager CRM Prodotto: Ekushey Project Manager CRM Versione: 5.0 Vulnerabilità: Cross-Site Scripting XSS persistente CWE: CWE-79 CVE: CVE-2026-26211 Ricercatore: LINDAN TRI SAPUTRA Segnalazione iniziale: 1 agosto 2026 Sommario È stata identificat...

CVE-2025-61454

🛡️ Divulgazione CVE: CVE-2025-61454 — XSS Riflesso in Progetto E-commerce Data di divulgazione: 14 ottobre 2025 ID CVE: CVE-2025-61454 Gravità: MEDIA CVSS 6.1 🧩 Riepilogo Esiste una vulnerabilità di Cross-Site Scripting XSS riflesso nel Progetto E-commerce v1.0, in particolare nell'endpoint...

CVE-2026-32247

CVE-2026-32247 — Iniezione Cypher in graphiti-core tramite nodelabels non sanificati Gravità : Alta CVSS 8.1 CWE : CWE-943 — Neutralizzazione impropria di elementi speciali nella logica delle query di dati Componente interessato : graphiti-core = 0.28.1 pip Corretto in : 0.28.2 Avviso : GHSA NVD ...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Exploração de XSS DOM no Roundcube Webmail 📋 Informações da Exploração Título da Exploração: XSS DOM no Roundcube Webmail via href em SVG CVE-2026-25916 Autor: Mohammed Idrees Banyamer Contato: GitHub @mbanyamer | Instagram @banyamersecurity País: Jordânia Data: 9 de fevereiro de...

CVE-2026-25596

CVE-2026-25596 — XSS persistente tramite il campo Nome Unità di Prodotto in InvoicePlane 1.7.0 Vulnerabilità: Cross-Site Scripting XSS persistente tramite il campo Nome Unità di Prodotto Prodotto: InvoicePlane Versione interessata: 1.7.0 e probabilmente versioni precedenti Gravità: Media Punteggi...

CVE-2026-25595

CVE-2026-25595 — Stored XSS über die Rechnungsnummer in InvoicePlane 1.7.0 Schwachstelle: Stored Cross-Site Scripting XSS über das Feld Rechnungsnummer Produkt: InvoicePlane Betroffene Version: 1.7.0 und vermutlich frühere Versionen Schweregrad: Mittel CVSS 3.1-Score: 4.8...

CVE-2026-25594

CVE-2026-25594 — Stored XSS über den Familiennamen in InvoicePlane 1.7.0 Schwachstelle: Stored Cross-Site Scripting XSS über das Feld „Familienname“ Produkt: InvoicePlane Betroffene Version: 1.7.0 und vermutlich frühere Versionen Schweregrad: Mittel CVSS 3.1-Score: 4.8...

CVE-2026-0709

Ferramenta Hikvision Wireless AP – RCE Autenticado CVE-2026-0709 Esta ferramenta é uma prova de conceito em Python para testar pontos de acesso sem fio Hikvision quanto à CVE-2026-0709 , uma vulnerabilidade de injeção de comandos autenticada que pode levar à execução remota de código em...

CVE-2021-40222

CVE-2021-40222 Приложение : Rittal CMC PU III Web management Устройства : CMC PU III 7030.000 Версия ПО : V3.11.002 Версия аппаратного обеспечения : V3.00 Тип атаки : Удаленное выполнение кода Решение : Обновите версию ПО до V3.17.10 или новее Краткое описание : Веб-приложение не очищает...

CVE-2026-30048

CVE-2026-30048 - Cross-Site Scripting XSS persistente in NotChatbot WebChat = 1.5.0 Riepilogo Esiste una vulnerabilità di Cross-Site Scripting XSS persistente nel pacchetto @developer.notchatbot/webchat nelle versioni fino alla 1.5.0 inclusa. L'input fornito dall'utente non viene adeguatamente...

CVE-2025-65321

CVE-2025-65321 O bot do Discord Language Sloth é vulnerável a Directory Traversal nas funções gif e png. As funções constroem caminhos de arquivo usando entrada do usuário não sanitizada para o parâmetro 'name', permitindo que atacantes referenciem arquivos fora dos diretórios de recursos...

PT-2026-82738

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

CVE-2024-10914__POC

CVE-2024-10914 - Konzeptnachweis Exploit für eine Command Injection-Schwachstelle im Endpunkt /cgi-bin/accountmgr.cgi. Diese Schwachstelle ermöglicht die Ausführung beliebiger Befehle auf dem betroffenen System über nicht bereinigte Parameter. Beschreibung der Schwachstelle CVE-2024-10914 ist ein...

CVE-2026-40176-poc

CVE-2026-40176: Composer Perforce OS-Befehlseinschleusung PoC English version Übersicht Dieses Repository enthält einen Proof of Concept PoC für die kritische OS-Befehlseinschleusungs-Schwachstelle CVE-2026-40176 , die im Perforce VCS-Treiber von Composer vorhanden ist. Die Schwachstelle betrifft...