115741 matches found
CVE-2026-16610
CVE-2026-16610 , for the Admin and Site Enhancements (ASE) Pro WordPress plugin, is documented as allowing unauthenticated remote code execution in all versions up to 8.9.0 via the recursive_html function. The root cause is a vulnerable frontend save handler that relies on a publicly emitted nonc...
EUVD-2026-50966
The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...
CVE-2026-14356 FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint
The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...
PT-2026-66348
Name of the Vulnerable Software and Affected Versions ADM versions 4.1.0 through 4.3.3.RUN1 ADM versions 5.0.0 through 5.1.3.RI81 Description A stored format string vulnerability exists in the FTP Backup feature. This occurs when user-controlled backup configuration data is written to a task log...
PT-2026-66393
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...
PT-2026-66562
Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An issue exists where the '/server info' endpoint returns sensitive API keys and SSL keyfile information. This occurs specifically when only the --admin-api-key is configured. Recommendations ...
CVE-2025-65341
Ecommerce Fruits Bazar version 1.0 is vulnerable to Cross-Site Scripting (XSS) within the admin/edit_product.php endpoint. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users. No specific remediation or patch information is currently available in the prov...
CVE-2026-52539
Outstatic CMS versions
PT-2026-66574
Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.6.0 Description Authenticated non-admin users can enumerate sequential custom option IDs to read labels belonging to admin-only user or group custom fields. This occurs because the endpoint "/api/v3/custom...
PT-2026-66591
Name of the Vulnerable Software and Affected Versions Outstatic CMS versions prior to 2.2.0 Description The application contains a hardcoded JSON Web Token JWT signing secret. If the OST TOKEN SECRET environment variable is not configured, the system uses a default secret available in the public...
CVE-2026-52539
Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...
PT-2026-66597
Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.7 Description TenantResource RawItems and Generators in internal/controllers/resources/collect.go, specifically within the handleRawItem and handleGeneratorItem functions, fail to apply the...
CVE-2025-65341: Improper Neutralization of Input During Web Page Generation
Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...
CVE-2025-65341
Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...
PT-2026-66598
Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard version 3.0.0 Description A stored cross-site scripting issue exists where unauthenticated remote attackers can inject arbitrary HTML and script payloads. This occurs when a crafted username is submitted in a failed login PO...
PT-2026-66385
Name of the Vulnerable Software and Affected Versions tourmaster WordPress plugin versions prior to 5.4.8 Description The plugin fails to perform a nonce check when storing a custom-filter label received from a request parameter and does not escape this label when displaying it on the filter admi...
CVE-2026-52539
Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...
CVE-2026-65834: Improper Input Validation
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...