198 matches found
CVE-2026-111956
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...
EUVD-2026-107078
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...
PT-2026-120473
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...
CVE-2026-63154
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
CVE-2026-63154
Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a SQL identifier injection vulnerability during the user import flow. The root cause is the use of unvalidated caller-controlled agoraFields[] names as SQL column identifiers. A space administrator can exploit this to escalate pr...
CVE-2026-63154
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
EUVD-2026-100567
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
CVE-2026-63154: Improper Neutralization of Special Elements used in an SQL Command
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
PT-2026-113333
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
Linux Distros Unpatched Vulnerability : CVE-2026-49469
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria...
CVE-2026-49469
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...
CVE-2026-49469
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...
UBUNTU-CVE-2026-49469
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...
CVE-2026-49469 GLPI: LDAP filter injection in user import feature
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...
CVE-2026-49469 GLPI: LDAP filter injection in user import feature
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...
CVE-2026-49469
The asset and IT management software GLPI is vulnerable to an LDAP filter injection in the user import feature. In versions 0.70 through 10.0.26 and 11.0.8 , an authenticated hotliner or technician can submit crafted criteria to bypass the configured default LDAP filter. This allows the attacker ...
EUVD-2026-87272
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...
CVE-2026-49469 GLPI: LDAP filter injection in user import feature
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...