CVE-2026-102293

A vulnerability exists in realjerrytang tacomall 1.0.0 within the api-admin Backend component. Specifically, the OrgStaffServiceImpl.add function in the ApiMaApplication.java file is susceptible to improper authorization when the isAdmin/jobId arguments are manipulated. This flaw allows for remot...

EUVD-2026-88643

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack ...

CVE-2026-102261 owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleoncms/admin/mediacontroller.rb of the component Media Crop Handler. This manipulation of the argument savedavatar causes authorization bypass. The attack may be initiated...

Custom-Nuclei-Templates

Custom Nuclei Templates This collection of Nuclei templates is designed to enhance your security testing capabilities. Made a few custom templates and i might add more as time goes on. Introduction Nuclei is a powerful tool for fast and customizable vulnerability scanning. This repository contain...

EUVD-2026-88561

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-102364

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

PT-2026-102672

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2026-102364: Improper Authentication

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102293: Improper Authorization

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack ...

PT-2026-102507

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2022-51019: Improper Neutralization of Special Elements used in an OS Command

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

PT-2026-102627

🚨 CVE-2026-102569 ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video moderation permission...

CVE-2026-102569: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...

CVE-2026-41875: Cross-Site Request Forgery (CSRF)

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

Debian dla-4800 : glance - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4800 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4800-1 [email protected]...

PT-2026-102724

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

PT-2026-102453

Name of the Vulnerable Software and Affected Versions realjerrytang tacomall version 1.0.0 Description An improper authorization issue exists in the api-admin Backend component within the file ApiMaApplication.java. The flaw occurs in the OrgStaffServiceImpl.add function, where manipulating the...

Important: gvfs

Issue Overview: A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buff...

PT-2026-102817

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

SUSE CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...