Lucene search
+L

90555 matches found

CVE
CVE
added 2026/06/13 6:0 a.m.41 views

CVE-2026-9062

The CVE-2026-9062 entry concerns the Store Locator WordPress plugin (affected versions prior to 1.6.9). The vulnerability arises from insufficient validation of a parameter used in a file path, enabling high-privilege users (e.g., administrators) to read arbitrary PHP files from the server, inclu...

3.4CVSS5.5AI score0.00248EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/13 6:0 a.m.41 views

CVE-2026-9061 Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name

The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks...

0.00145EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/13 6:0 a.m.10 views

CVE-2026-9062 Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...

5.5AI score0.00248EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/13 6:0 a.m.12 views

CVE-2026-9061 Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name

The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks...

5.2AI score0.00145EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/13 6:0 a.m.30 views

CVE-2026-9061

CVE-2026-9061 affects the Store Locator WordPress plugin prior to 1.6.9. The description in the provided documents states that store logo metadata is not sanitized/escaped before storage and output on the admin page, allowing high-privilege users (e.g., administrators) to perform a Stored XSS att...

3.5CVSS5.3AI score0.00145EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/13 6:0 a.m.19 views

EUVD-2026-36644

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...

5.5AI score0.00248EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/13 6:0 a.m.17 views

EUVD-2026-36643

The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks...

5.3AI score0.00145EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/13 12:34 a.m.28 views

EUVD-2026-36621

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching t...

7.7CVSS5.2AI score0.00179EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/13 12:34 a.m.35 views

EUVD-2026-36609

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execut...

8.8CVSS5.4AI score0.00289EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/13 12:0 a.m.28 views

PT-2026-49099

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability CWE-287 in the system configuration module. The /php/ajax-login.php endpoint returns userid=1 administrator in response to any HTTP POST request that supplie...

9.8CVSS5.6AI score0.00441EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/13 12:0 a.m.27 views

PT-2026-49079

Name of the Vulnerable Software and Affected Versions Store Locator WordPress plugin versions prior to 1.6.9 Description Insufficient sanitization and escaping of store logo metadata before it is stored and displayed on the admin page allows high-privileged users, such as administrators, to execu...

3.5CVSS5.4AI score0.00145EPSS
SaveExploits0References6
Snyk
Snyk
added 2026/06/12 11:9 p.m.11 views

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the trusted-proxy Control UI WebSocket process. An attacker can gain unauthorized administrative privileges by connecting as an unpaired or restricted client and...

8.8CVSS5.9AI score0.00289EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/12 10:16 p.m.19 views

CVE-2026-53833

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching t...

7.7CVSS0.00179EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/12 10:16 p.m.18 views

CVE-2026-53821

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execut...

8.8CVSS0.00289EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/12 10:16 p.m.33 views

CVE-2026-53519

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefi...

9.1CVSS0.00534EPSS
SaveExploits1References1
NVD
NVD
added 2026/06/12 10:16 p.m.20 views

CVE-2026-47124

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users...

6.5CVSS0.0027EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/12 9:56 p.m.11 views

CVE-2026-53833 QQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming Command

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching t...

7.7CVSS5.2AI score0.00179EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/06/12 9:56 p.m.10 views

CVE-2026-53821 OpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocket

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execut...

8.8CVSS5.4AI score0.00289EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/12 9:56 p.m.51 views

CVE-2026-53821

OpenClaw is affected: prior to 2026.5.18, WebSocket control UI accepts client-declared operator scopes before server-approved pairing/trusted-proxy binding. This enables unpaired/restricted trusted-proxy Control UI clients to obtain cached operator.admin authority on live WebSocket connections an...

8.8CVSS5.5AI score0.00289EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2026/06/12 9:56 p.m.44 views

CVE-2026-53821 OpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocket

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execut...

8.8CVSS0.00289EPSS
SaveExploits0References2
Rows per page
Query Builder