114432 matches found
CVE-2025-69948
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...
CVE-2025-69948: Improper Neutralization of Special Elements used in an SQL Command
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...
CVE-2026-52371
A Server-Side Request Forgery (SSRF) vulnerability exists in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 . This flaw allows authenticated attackers to scan internal resources by providing a crafted HTTP request , forcing the server to make requests to unintended locations. No in...
PT-2026-66834
Name of the Vulnerable Software and Affected Versions AWS Ops Wheel versions prior to PR 168 Description Stored cross-site scripting occurs during the handling of participant URLs. An authenticated remote user can exploit this by providing a crafted participant url value containing a dangerous UR...
PT-2026-66722
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check t...
CVE-2026-13609: Improper Neutralization of Input During Web Page Generation
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live ta...
PT-2026-66866
Name of the Vulnerable Software and Affected Versions xxl-job version 3.4.0 Description A Server-Side Request Forgery SSRF exists in the 'xxl-job-admin/jobinfo/trigger' endpoint. This issue allows authenticated attackers to scan internal resources by sending a specially crafted HTTP request. SSRF...
PT-2026-66860
Name of the Vulnerable Software and Affected Versions Modern Loan Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, at the '/admin/delete group.php' endpoint via the id...
Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66273)
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...
Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2671)
Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware L 1.10 allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 val parameter to admin/adminmain.html; 3 id, 4 val, or 5 arbitrary parameter name QUERYSTRING to...
CVE-2026-66420
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...
CVE-2026-66421
OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...
CVE-2026-66421 OpenClaw Dashboard Stored XSS via lastMessage Session Field
OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...
CVE-2026-66421 OpenClaw Dashboard Stored XSS via lastMessage Session Field
OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...
CVE-2026-66421
OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...
CVE-2026-66421
The CVE-2026-66421 entry documents a stored cross-site scripting vulnerability in OpenClaw Dashboard. The issue arises from processing agent transcript messages via the sessions API, where attacker-supplied HTML markup (for example, an inline event handler in an img tag) can be stored in a sessio...
CVE-2026-66420
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...
CVE-2026-66418
OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...
CVE-2026-52539
Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...