Lucene search
+L

89698 matches found

Cvelist
Cvelist
added 4 days ago35 views

CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

0.00192EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago9 views

EUVD-2026-50990

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

6.8CVSS5.9AI score0.00297EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago39 views

CVE-2026-15235 Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...

0.00224EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago39 views

CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

0.00297EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago8 views

CVE-2026-15153

The CVE-2026-15153 entry concerns the WP Hotel Booking WordPress plugin (versions prior to 2.3.2). The underlying issue is that a search parameter on an administrative listing is not properly sanitised or escaped before its value is interpolated into a SQL query, enabling SQL injection by users w...

6.8CVSS5.9AI score0.00297EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-50986

The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...

6.1CVSS5.9AI score0.00209EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago32 views

CVE-2026-16610

CVE-2026-16610 , for the Admin and Site Enhancements (ASE) Pro WordPress plugin, is documented as allowing unauthenticated remote code execution in all versions up to 8.9.0 via the recursive_html function. The root cause is a vulnerable frontend save handler that relies on a publicly emitted nonc...

9.8CVSS6.2AI score0.00578EPSS
SaveExploits0References2
Cvelist
Cvelist
added 4 days ago44 views

CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

9.8CVSS0.00578EPSS
SaveExploits0References2
Cvelist
Cvelist
added 4 days ago37 views

CVE-2026-14356 FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

8.8CVSS0.00269EPSS
SaveExploits0References2
EUVD
EUVD
added 4 days ago14 views

EUVD-2026-50966

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

8.8CVSS5.8AI score0.00269EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 4 days ago6 views

PT-2026-66468

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

8.8CVSS5.9AI score0.00188EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago11 views

PT-2026-66562

SGLang contains a credential leakage vulnerability in the /server info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...

5.9AI score0.00241EPSS
SaveExploits0References3
Cvelist
Cvelist
added 4 days ago28 views

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

0.00303EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 4 days ago8 views

PT-2026-66597

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.7 Description TenantResource RawItems and Generators in internal/controllers/resources/collect.go, specifically within the handleRawItem and handleGeneratorItem functions, fail to apply the...

6.6CVSS5.5AI score0.00192EPSS
SaveExploits0References7
CVE
CVE
added 4 days ago10 views

CVE-2025-65341

CVE-2025-65341 affects Ecommerce Fruits Bazar 1.0 and is described as a Cross Site Scripting (XSS) vulnerability in the script admin/edit_product.php. The associated metrics show CVSS v3.1 base score 6.1 (Medium) with attack vector Network, attack complexity Low, privileges Required None, user in...

6.1CVSS5.8AI score0.00149EPSS
SaveExploits0References1
Cvelist
Cvelist
added 4 days ago29 views

CVE-2025-65341

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...

0.00149EPSS
SaveExploits0References1
CVE
CVE
added 4 days ago12 views

CVE-2026-52539

CVE-2026-52539 affects Outstatic CMS

9.1CVSS6.1AI score0.00303EPSS
SaveExploits0References2
EUVD
EUVD
added 4 days ago8 views

EUVD-2025-210560

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...

5.8AI score0.00149EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 4 days ago5 views

MantisBT 1.3.0 < 2.28.4 RCE (GHSA-v84x-qvhg-f36r)

The version of MantisBT installed on the remote host is 1.3.0 or later but prior to 2.28.4. It is, therefore, affected by a vulnerability: - A remote code execution vulnerability exists in the admin Manage Configuration feature admconfigset.php. When setting a configuration value with a non-strin...

6.7AI score
SaveExploits0References2
NVD
NVD
added 5 days ago6 views

CVE-2026-15831

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during tok...

4.3CVSS0.00236EPSS
SaveExploits0References2
Rows per page
Query Builder