115803 matches found
CVE-2026-42722
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-42722
The Frontend Admin by DynamiApps WordPress plugin, in versions
CVE-2026-42722 WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
EUVD-2026-96452
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-42722 WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
Incorrect Authorization
Overview @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Incorrect Authorization via reconcileTokenPermissionsToUserCeiling, which ignores token permissions with omitted or null fields. When an administrator restricts a role's field-level access in the Content...
@akbarsafari00/bonyan (>=5.52.1-fa.2, <=5.52.1-fa.4), @akbarsafari00/strapi (5.52.1-fa.1) +22 more potentially affected by CVE-2026-108114 via @strapi/admin (>=5.47.0, <=5.59.0)
@strapi/admin NPM version =5.47.0, =5.52.1-fa.2, =2.3.1, =0.0.1, =2.7.3-tenant.0, =0.1.0, =1.0.1, =1.0.1, =5.47.0, =5.47.0, =5.47.0, =0.1.0, =0.2.0, =0.0.0, =0.1.2 and more Source cves: CVE-2026-108114 Source advisory: SNYK:JS-STRAPIADMIN-20883239...
Rill Data rill authorization issue vulnerability
In the Rill Data version 0.77.0 to 0.90.5, there is an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification on the admin OAuth server. Authorization codes are issued to dynamically registered clients without obtaining user consent. This allows...
CVE-2026-108114
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
CVE-2026-108114
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
EUVD-2026-96338
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...
CVE-2026-108114
Strapi versions 5.47.0 through 5.57.0 are vulnerable to an improper authorization flaw (CWE-863) involving Admin API tokens. The root cause lies in the reconcileTokenPermissionsToUserCeiling function, which fails to account for token permissions containing omitted or null fields . Consequently, e...
CVE-2025-57310
CVE-2025-57310 A Cross-Site Request Forgery CSRF vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Base Score: 8.8 High...
SourceCodesterUnrestrictedFileUploadLeadingtoRemoteCode-Execution
sourcecodester Online Food Ordering System in PHP and MySQL So...
CVE-2026-6243
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...
CVE-2026-6243 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...
CVE-2026-6243 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...