115781 matches found
CVE-2026-108923
The 1024-lab smart-admin software (up to version 3.30.0 ) contains an improper access control vulnerability in the Support Config Query component. Specifically, a manipulation of the configKey argument within the /support/config/queryByKey file allows for unauthorized actions. This vulnerability ...
EUVD-2026-97783
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...
CVE-2026-108923 1024-lab smart-admin Support Config Query queryByKey access control
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...
CVE-2026-108923 1024-lab smart-admin Support Config Query queryByKey access control
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...
CVE-2026-108920 SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting
A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/userrecord.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launch...
EUVD-2026-97759
A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/userrecord.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launch...
CVE-2026-108920
The SourceCodester Drug Recommendation System 1.0 is vulnerable to cross-site scripting (XSS) within the Admin Record Tables component. The vulnerability exists in an unspecified function of the Admin/user_record.php file, where the manipulation of the name/email argument allows for remote execut...
CVE-2026-108920 SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting
A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/userrecord.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launch...
CVE-2026-63030
CVE-2026-63030 WordPress REST API batch route confusion + SQL injection leading to unauthorized admin creation → Remote Code Execution RCE complete exploit chain PoC. For authorized security testing, vulnerability reproduction, and research only. Do not use against unauthorized targets...
CVE-2026-109357
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...
CVE-2026-109322
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...
CVE-2026-109316
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files...
CVE-2026-109317
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...
CVE-2026-109237
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with apitoken set to an env reference via /config/dump to read SECRETK...
CVE-2026-109392
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...
CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...
CVE-2026-109357
LibreNMS versions before 26.9.0 are vulnerable to an LDAP filter injection in ldap-authorization and ad-authorization modes. The root cause is the insertion of unescaped usernames into LDAP search filters combined with an authentication mechanism that only verifies user existence. If REMOTE_USER ...
CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...
CVE-2026-109357
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...
EUVD-2026-97659
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...