CVE-2026-55163

Lemur (Netflix TLS certificate management tool) has an authorization bypass in PUT /api/1/roles/ (lemur/roles/views.py:298): RoleMemberPermission uses OR-semantics, so any existing role member can add/remove other users and rename the role. The companion DELETE handler already required admin perm...

CVE-2026-39374

Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member ADMIN or MEMBER to modify the startdate and targetdate of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches...

PT-2026-31005

Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member ADMIN or MEMBER to modify the start date and target date of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches...

EUVD-2026-16118

A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipulation of the argument Search causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The...

CVE-2026-4845

A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipulation of the argument Search causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The...

CVE-2026-4845

CVE-2026-4845 affects dameng100 muucmf 1.9.5.20260309: an unknown function in /admin/Member/index.html is vulnerable. Manipulating the Search argument triggers cross-site scripting (XSS). The issue can be initiated remotely, and an exploit has been published. Vendor was contacted but did not resp...

CVE-2026-4845 dameng100 muucmf index.html cross site scripting

A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipulation of the argument Search causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The...

CVE-2026-4845

A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipulation of the argument Search causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The...

MuuCmf 代码注入漏洞

MuuCmf is an open-source application development framework created by Dameng100. Version muucmf 1.9.5.20260309 contains a code injection vulnerability. This vulnerability stems from incorrect handling of parameters in the file admin/Member/index.html, specifically the parameter Search, which may...

CVE-2026-4845: Improper Neutralization of Input During Web Page Generation

A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipulation of the argument Search causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The...

EUVD-2019-7643

Malware in sbrugna...

EUVD-2019-3053

Malware in sbrugna...

CVE-2024-7276

A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/membersave.php. The manipulation of the argument last/first leads to sql injection. The attack can be launched...

CVE-2019-17225

Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue...

CVE-2025-4865

A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/membersave.php. The manipulation of the argument last leads to sql injection. The attack may be initiated remotely. The exploit has...

CVE-2025-3336

A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/membersave.php. The manipulation of the argument last leads to sql injection. The attack can be initiated remotely. The...

CVE-2024-7276

A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/membersave.php. The manipulation of the argument last/first leads to sql injection. The attack can be launched...

itsourcecode Alton Management System SQL注入漏洞

Alton Management System is an open source content management system from itsourcecode. A SQL injection vulnerability exists in version 1.0 of itsourcecode Alton Management System, which is caused by a SQL injection vulnerability in the last/first function of the /admin/membersave.php page...

PT-2024-38225 · Unknown · Alton Management System

Name of the Vulnerable Software and Affected Versions: Alton Management System version 1.0 Description: A critical issue has been found in the Alton Management System, affecting an unknown functionality of the file /admin/member save.php. The manipulation of the last and first arguments leads to...

Subrion 4.2.1 - (Email) Persistant Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting Author: Min Ko Ko Creatigon Vendor Homepage: https://subrion.org/ CVE : https://nvd.nist.gov/vuln/detail/CVE-2019-17225 Website : https://l33thacker.com Description : Allows XSS vi...