114661 matches found
PT-2026-65091
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Ticket...
CVE-2026-51564
An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...
CVE-2026-51565
A Cross-site scripting (XSS) vulnerability exists in the Modules/Docs/DocsController.php component of Milk admin versions
PT-2026-65313
Name of the Vulnerable Software and Affected Versions Milk admin versions prior to 0.9.9 Description Cross-site scripting XSS occurs in the Modules/Docs/DocsController.php file. This issue allows remote attackers to inject arbitrary HTML or web scripts through the action parameter in a specially...
PT-2026-65080
Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 Devolutions Server versions 2026.1.23.0 and earlier Description Improper access control in the role membership management endpoint allows an authenticated non-administrative user with...
PT-2026-65311
Name of the Vulnerable Software and Affected Versions Milk admin versions 0.9.8 and earlier Description An issue exists where remote attackers can redirect users to arbitrary external URLs by sending a crafted request. This is caused by improper handling of the redirect parameter. Recommendations...
PT-2026-65115
Name of the Vulnerable Software and Affected Versions JFrog Platform affected versions not specified Description An authorization flaw allows an authenticated user to perform privilege escalation under admin-provisioned account conditions. Successful exploitation of this issue may grant the...
PT-2026-65106
Name of the Vulnerable Software and Affected Versions JFrog affected versions not specified Description Incorrect authorization validation in the refresh token signature allows users without administrative privileges to obtain a signed JFrog administrator token, leading to potential privilege...
PT-2026-64836
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...
CVE-2026-51565
Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...
CVE-2026-51564
An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...
CVE-2026-51564
An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...
CVE-2026-51564
An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...
PT-2026-64876
A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...
CVE-2026-51564
The Milk admin software (versions
CVE-2026-55579: Use of Hard-coded Credentials
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...
CVE-2026-17192: Server-Side Request Forgery (SSRF)
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered...
CVE-2026-51565
Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...
