PT-2026-82668

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=...

CVE-2026-65931: Missing Authorization

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

PT-2026-82793

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

CVE-2026-80210: Cross-Site Request Forgery (CSRF)

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-80211: Use of Password Hash With Insufficient Computational Effort

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

CVE-2026-75419

go-wind-cms (GoWind) before 1.0.0 suffers from a missing authorization flaw. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), causing the authz middleware to always allow requests...

CVE-2026-37066

The Veno File Manager Project 4.4.9 is vulnerable to a path traversal flaw within the /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php endpoints. This vulnerability allows an authenticated attacker with a super administrator role to perform an Arbitrary File Read , potentially disclosing se...

CVE-2026-37069: Exposure of Sensitive Information to an Unauthorized Actor

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

PT-2026-82674

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

PT-2026-82675

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

EUVD-2026-67258

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

CVE-2026-37072

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

CVE-2025-62343: Undefined Security Weakness

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

CVE-2026-37072: Improper Access Control

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

...[ More ]

kamalpanse18 EmpManageX, a Flask-based employee management application, ships hard-coded administrative credentials in its authentication logic. The username admin and the plaintext password admin123 are module-level constants in app.py, compared directly against the values submitted to the...

CVE-2026-37072

The Veno File Manager Project version 4.4.9 is vulnerable to Incorrect Access Control in the admin-head-updates.php file. An unauthenticated attacker can exploit a Local File Inclusion (LFI) vulnerability via the lang GET parameter. By sending a specially crafted POST request with the correct fil...

CVE-2026-55182

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An...

CVE-2017-7921

CVE-2017-7921 CVE-2017-7921-EXP Hikvision camera यह उपकरण मुख्य रूप से कानूनी रूप से अधिकृत पैठ परीक्षण सुरक्षा पेशेवरों और नियमित संचालन करने वाले वेबसाइट प्रशासकों के लिए है। किसी को भी इसे अवैध उद्देश्यों या लाभ कमाने के लिए उपयोग नहीं करना चाहिए, अन्यथा परिणाम स्वयं भुगतने होंगे और उनकी...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...