115809 matches found
EUVD-2026-43623
A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...
CVE-2026-15675
A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...
Exploit for CVE-2026-52614
CVE-2026-52614 – RuoYi v4.8.3 filterKeyword bypass SQL injec...
Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware
CVE-2017-7921 — Hikvision IP Camera / DVR / NVR Improper Au...
GHSA-RW46-QG69-VG6H Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
Summary The ExportController web routes for creating and editing export templates are gated only by the class-level createexport permission, which is granted to ROLETEAMLEAD by default. The corresponding API routes and UI button visibility correctly require the stricter createexporttemplate...
EUVD-2026-43575
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php executes bucket commands ls, upload, removefiles, rename, createfolder without performing any ACL or role check. Any authenticated...
EUVD-2026-43556
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...
EUVD-2026-43564
OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization...
CVE-2026-36214: Improper Neutralization of Input During Web Page Generation
osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions...
CVE-2026-15703: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument userid results in sql injection. It is possible to initiate the attack remotely...
CVE-2026-15676: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the...
PT-2026-58103
Name of the Vulnerable Software and Affected Versions osTicket versions 1.10 through 1.17.7 osTicket versions 1.18.0 through 1.18.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient HTML sanitization and a vulnerable Bootstrap Tooltip component. This allows remote attackers t...
PT-2026-58855
Name of the Vulnerable Software and Affected Versions Citrix XenServer SDK versions prior to 26.15.0 XenCenter versions prior to 2026.4.0 Description Some SDKs lack proper TLS verification during network communication with a host running XAPI. This flaw allows an attacker to perform a...
PT-2026-60889
Name of the Vulnerable Software and Affected Versions Schneider Electric EcoStruxure Cybersecurity Admin Expert affected versions not specified Description Insufficient protection of stored credentials within the application allows a local privileged attacker to bypass authentication and perform...
PT-2026-57968
A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add judges.php. This manipulation of the argument fname causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and...
PT-2026-58280
Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally...
CVE-2026-56185: Improper Authentication
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network...
CVE-2026-56196: Relative Path Traversal
Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network...
CVE-2026-56197: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in Windows Admin Center allows an authorized attacker to execute code over a network...