PT-2026-66690

Name of the Vulnerable Software and Affected Versions ElementsKit Elementor Addons versions prior to 3.10.01 Description An issue exists where custom-widget definitions saved by users with administrative privileges are written verbatim into a generated PHP file, which is subsequently executed by...

EUVD-2025-210575

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66279)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS and QuTS hero Stack-based Buffer Overflow (CVE-2025-66280)

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

PT-2026-66730

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before...

EUVD-2026-51644

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

CVE-2025-67651: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

PT-2026-66750

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

Qnap QTS and QuTS hero Path Traversal (CVE-2026-24717)

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the...

JFrog Artifactory 7.146.x < 7.146.34 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66273)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2671)

Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware L 1.10 allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 val parameter to admin/adminmain.html; 3 id, 4 val, or 5 arbitrary parameter name QUERYSTRING to...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

PT-2026-66749

Name of the Vulnerable Software and Affected Versions PHP Jabbers scripts affected versions not specified Description A Cross-Site Request Forgery CSRF issue exists due to the absence of CSRF tokens or appropriate SameSite attributes. This allows an attacker to send unauthorized requests using th...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-16105: Authorization Bypass Through User-Controlled Key

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

CVE-2025-69948: Improper Neutralization of Special Elements used in an SQL Command

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...