CVE-2026-30498

A CSRF vulnerability (CVE-2026-30498) affects Jason2605 AdminPanel 4.0, located in the delete.php endpoint. The issue is described across multiple sources as CSRF; no explicit exploit details, mitigations, or patch information are provided in the connected documents. CVSS v3.1 metrics indicate a ...

Slican多款产品 安全漏洞

Slican IPL is a product of the Polish company Slican. Slican IPL is an Internet Protocol private branch exchange. Slican IPM is an IP phone exchange server. Slican CCT is a series of enterprise communication and IP phone exchange systems. Several Slican products have security vulnerabilities; the...

PT-2026-43596

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical...

PT-2026-43547

The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lvca admin ajax AJAX action in all versions up to, and including, 3.9.4 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce...

PT-2026-43471

Name of the Vulnerable Software and Affected Versions QianFox FoxCMS versions prior to 1.2.7 Description A flaw exists in the Edit function within the Admin.php file that allows for weak password recovery. This issue can be exploited remotely by an attacker. Recommendations At the moment, there i...

Netis AC1200 安全漏洞

The Netis AC1200 is a series of dual-band wireless broadband routers produced by the Chinese company Netis. The Netis AC1200 V4.0.1.4296 version contains a security vulnerability. This vulnerability stems from the CGI endpoint/cgi-bin/skkget.cgi function, which can return the entire router...

PT-2026-44048

Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel. This vulnerability stems from the vport netlink reply helper function, which allocates skb packets of a fixed size but h...

PT-2026-43524

The Instant-Quote.co Quotation Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-38807

The CVE-2026-38807 entry concerns an insecure permissions vulnerability in kvf-admin v1.0.0 that enables a remote attacker to escalate privileges via the UserController.java component. Affected software is kvf-admin; the root cause is insecure access control in UserController.java leading to unau...

CVE-2026-38807

Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component...

WordPress plugin Search Simple Fields 跨站请求伪造漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

SimplePHP 安全漏洞

SimplePHP is a lightweight CMS tool based on JSON files, developed by Martin personally. SimplePHP has a security vulnerability, which stems from the/admin/config-module.php component having a storage-based cross-site scripting vulnerability. This vulnerability can be exploited by injecting...

CVE-2026-38931

A stored cross-site scripting XSS vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff Latest as of 2026-02-27 via injecting a crafted payload...

PT-2026-44061

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0 Description An issue exists in the open-source low-code platform where the '/api/public/v1/roles/assign' endpoint is guarded by the builderOrAdmin middleware. This middleware allows any user who is a builder f...

CVE-2026-38931

A stored cross-site scripting XSS vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff Latest as of 2026-02-27 via injecting a crafted payload...

PT-2026-44065

Name of the Vulnerable Software and Affected Versions Archer BE450 v1 Archer BE7200 v1 Description An authenticated command injection allows an administrator to execute arbitrary system commands through the web management interface. By using the browser developer console, a crafted input can be...

PT-2026-44152

Name of the Vulnerable Software and Affected Versions Automad versions 2.0.0-alpha.1 through 2.0.0-beta.27 Description A broken access control issue allows an unauthenticated attacker to retrieve the bcrypt password hashes of all administrator accounts via a single POST request. The setup endpoin...

CVE-2026-38931

A stored cross-site scripting XSS vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff Latest as of 2026-02-27 via injecting a crafted payload...

PT-2026-43535

The Search Simple Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the search simple fields options function in functions admin.php. This makes it possible for unauthenticated...