mikrot8over

mikrot8over mikrot8over: strumento di sfruttamento rapido per Mikrotik RouterOS fino alla versione 6.38.4 Descrizione Questa è una rielaborazione dell'originale Mikrotik Exploit. Sono state aggiunte la compatibilità con Python 2 e funzionalità di scansione multithreading. Versione Python L'utilit...

EUVD-2026-66290

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

WordPress RegistrationMagic plugin < 6.0.9.4 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin RegistrationMagic versions 6.0.9.4...

CVE-2026-77790 RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-77790 RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

EUVD-2026-66276

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-80214

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

CVE-2026-80198

Kimai versions before 2.56.0 fail to restrict the config Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind...

Command Injection

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Command Injection in the Virtualization Discovery process. An attacker can execute arbitrary commands on the host...

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-80214 LibreNMS Virtualisation Discovery Module RCE

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

CVE-2026-80214 LibreNMS Virtualisation Discovery Module RCE

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

EUVD-2026-66227

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

CVE-2026-80214

LibreNMS 's Virtualization Discovery module is susceptible to command line injection , allowing an authenticated admin user to execute arbitrary code on the host server. The CVSS 4.0 base score is 8.6 (HIGH) , reflecting network reachability with low attack complexity but requiring high privilege...

CVE-2026-80214: Improper Neutralization of Special Elements used in an OS Command

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

CVE-2026-54553: Exposure of Sensitive Information to an Unauthorized Actor

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

CVE-2026-81203: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-81955

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

PT-2026-81923

Name of the Vulnerable Software and Affected Versions LibreNMS affected versions not specified Description The Virtualization Discovery module contains a command line injection flaw. This allows an authenticated administrator to execute arbitrary code on the host server. Recommendations At the...

PT-2026-82047

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Broken access control allows a user with organization administrator permissions to delete dashboard snapshots belonging to other organizations hosted on the same instance. Additionally, an...