15844 matches found
CVE-2018-25197
PlayJoom 0.10.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with option=complayjoom&view=genre&catid=SQL to extract sensitive...
OESA-2026-1536 mariadb security update
MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...
OESA-2026-1538 mariadb security update
MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...
OESA-2026-1537 mariadb security update
MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...
OliveTin 安全漏洞
OliveTin is an open-source web application developed by OliveTin. Versions of OliveTin prior to 300.11.1 contained security vulnerabilities. These vulnerabilities were due to authorization flaws, which could allow verified users with the view: false permission to enumerate bindings and metadata...
GHSA-JF73-858C-54PG OliveTin doesn't check view permission when returning dashboards
Summary An authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution exec may be correctly denied, the backend does not enforce IsAllowedView when constructing dashboard and...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the dashboard and API endpoints. An attacker can access sensitive action metadata, including titles, IDs, icons, and argument details, by sending crafted requests as an authenticated user with restricted view...
OliveTin doesn't check view permission when returning dashboards
Summary An authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution exec may be correctly denied, the backend does not enforce IsAllowedView when constructing dashboard and...
CVE-2026-26195 Gogs: Stored XSS in branch and wiki views through author and committer names
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2...
CVE-2026-26195 Gogs: Stored XSS in branch and wiki views through author and committer names
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2...
PT-2026-23617
Name of the Vulnerable Software and Affected Versions OliveTin versions prior to 3000.11.1 Description OliveTin has an authorization issue where authenticated users with insufficient permissions view: false can access metadata related to actions through the dashboard and API endpoints...
Kimai's API invoice endpoint missing customer-level access control (IDOR)
Summary GET /api/invoices/id only checks the role-based viewinvoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLETEAMLEAD which grants viewinvoice can read all invoices in the system, including those belonging to customers assigned to...
Incorrect Authorization
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the processing of Slack interactive callbacks, specifically blockaction, viewsubmission, and viewclosed. An attacker can inject unauthorized system-event text...
CVE-2026-2732
The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'RemoveBackGroundViewController::load' function in all versions up to, and including, 4.1.7. This makes it possible for authenticated attackers, with...
CVE-2025-48602
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitati...
CVE-2025-48577
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-26884
Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/admin/appointments/viewappointment.php...
CLEANSTART-2026-WY43835 PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access
Multiple security vulnerabilities affect the postgresql package. PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. See references for individual vulnerability details...
com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=14.81.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=14.62.0) +13 more potentially affected by CVE-2026-0540 via org.webjars.npm:dompurify (>=3.1.7, <=3.3.0)
org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.55.1 Source cves: CVE-2026-0540 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15371377...