CVE-2026-108829 Zen Cart Module Configuration modules.php sql injection

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The...

CVE-2026-108828

A SQL injection vulnerability exists in Zen Cart 2.2.2 within the Admin Panel component. The flaw resides in the eval function of the admin/configuration.php file, where manipulation of the gID argument allows for remote attack initiation. While the attack is considered to have high complexity an...

CVE-2026-108828 Zen Cart Admin Panel configuration.php eval sql injection

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

EUVD-2026-97335

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

CVE-2026-108815

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-108812

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CVE-2026-108815 idcCMS member_deal.php cross site scripting

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

EUVD-2026-97294

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-108815

A vulnerability exists in idcCMS 1.70 affecting an unknown function within the admin/member_deal.php file. This flaw allows for remote cross-site scripting (XSS) . The exploit has been disclosed to the public and may be used. Specific remediation steps or detailed root cause analysis are not prov...

CVE-2026-108812 SEMCMS SEMCMS_User.php user improper authorization

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CVE-2026-108812

A security vulnerability exists in SEMCMS versions up to 5.0 due to improper authorization within an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. This flaw allows for remote manipulation, potentially leading to unauthorized actions. The vendor has not responded to re...

EUVD-2026-97285

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CVE-2026-48211 Cross-Site Request Forgery in Import/Export Admin console

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery CSRF attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a...

CVE-2026-48211

The OTRS software is vulnerable to a Cross-Site Request Forgery (CSRF) attack in its Import/Export Admin console. The root cause is that the AdminImportExport::TemplateDelete action fails to validate the request's ChallengeToken . This allows an unauthenticated remote attacker to trick an authent...

CVE-2025-15703

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2025-15703 WP Job Openings < 4.0.0 - Admin+ Stored XSS

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2025-15703

The HireZoot WordPress plugin versions prior to 4.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape one of the job specification settings before it is reflected on an admin-area settings page. This allows users with management cap...

PT-2026-110733

Name of the Vulnerable Software and Affected Versions Grav Data Manager plugin versions 1.4.0 through 1.4.5 Description Missing authorization allows unauthenticated attackers to delete stored data files through the classic Admin integration. By sending a request containing the delete parameter...

CVE-2026-109171: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...

CVE-2025-15703: Improper Neutralization of Input During Web Page Generation

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...