Lucene search
+L

90781 matches found

Positive Technologies
Positive Technologies
added 2026/06/02 12:0 a.m.26 views

PT-2026-45702

The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'fpw fs get file' AJAX action in all versions up to, and including, 1.9.5. This is due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6AI score0.00192EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/02 12:0 a.m.25 views

PT-2026-45711

Name of the Vulnerable Software and Affected Versions JTL-Connector for WooCommerce versions prior to 2.4.2 Description The plugin contains missing authorization due to a lack of capability checks and nonce verification. This allows authenticated attackers with Subscriber-level access or higher t...

4.3CVSS5.6AI score0.00198EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/06/02 12:0 a.m.27 views

PT-2026-45882

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4 Description Users with only VIEW access to an MCP server can retrieve decrypted admin-managed secrets. This occurs through the endpoints "/api/mcp/servers" and "/api/mcp/servers/:serverName", where the returne...

6.5CVSS5.8AI score0.00276EPSS
SaveExploits1References3
CNNVD
CNNVD
added 2026/06/02 12:0 a.m.25 views

Alf.io 安全漏洞

Alf.io is a free and open-source attendance management system developed by Alf.io. Versions of Alf.io prior to 2.0-M5-2606 contained security vulnerabilities. These vulnerabilities stemmed from sandbox escape in the extended script engine. Combined with unprotected injection of Java object...

9.1CVSS5.8AI score0.00282EPSS
SaveExploits1References1
Tenable Nessus
Tenable Nessus
added 2026/06/02 12:0 a.m.33 views

Linux Distros Unpatched Vulnerability : CVE-2026-44825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hardcoded credentials in the Basic Authentication setup tool bin/solr auth enable in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attack...

9.8CVSS7.8AI score0.02161EPSS
SaveExploits2References2
Positive Technologies
Positive Technologies
added 2026/06/02 12:0 a.m.26 views

PT-2026-45778

A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of...

7.8CVSS5.7AI score0.00115EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/06/02 12:0 a.m.12 views

CVE-2026-35718

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any file on the device via sending a crafted request...

5.8AI score0.00723EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/02 12:0 a.m.24 views

PT-2026-45703

The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new domain' parameter in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

6.1CVSS6AI score0.00208EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/06/02 12:0 a.m.12 views

CVE-2026-30652

A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device...

6.4AI score0.00523EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/06/02 12:0 a.m.13 views

CVE-2026-30652

A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device...

6.4AI score0.00523EPSS
SaveExploits0References3
CVE
CVE
added 2026/06/02 12:0 a.m.31 views

CVE-2026-35716

CVE-2026-35716 describes a stack-based buffer overflow in the motion_privacy.cgi binary of VIVOTEK FD8136 firmware (FD8136-VVTK-0300a). The issue occurs when an oversized n1 parameter in a POST request to endpoints /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profil...

6.3CVSS6.5AI score0.00322EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/06/01 10:16 p.m.19 views

CVE-2026-40964

Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy accepts as a valid logs.admin token...

7.5CVSS0.00393EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/01 10:16 p.m.16 views

CVE-2018-25435

ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages...

6.9CVSS0.00156EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/06/01 10:13 p.m.17 views

CVE-2026-45279

A flaw was found in Nextcloud Server. This vulnerability allows non-admin users to perform a path traversal when the lang variable is used in the template directory configuration. An attacker can exploit this to copy arbitrary files, subject to existing Unix permissions, into their own Nextcloud...

6.5CVSS5.8AI score0.00392EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/06/01 10:3 p.m.21 views

CVE-2026-10178

A vulnerability was detected in code-projects Online Music Site 1.0. This vulnerability affects unknown code of the file /Administrator/PHP/AdminEditAlbum.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may ...

7.5CVSS5.7AI score0.00269EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/06/01 10:3 p.m.24 views

CVE-2026-44848

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, The Docker plugin management endpoints /plugins/ were not registered...

9.4CVSS5.7AI score0.00328EPSS
SaveExploits2References1
RedhatCVE
RedhatCVE
added 2026/06/01 10:3 p.m.24 views

CVE-2026-45631

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.27.0 to before 0.29.3, a hardcoded BETTERAUTHSECRET fallback "better-auth-secret-123456789" lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the...

10CVSS5.9AI score0.00351EPSS
SaveExploits0References1
Snyk
Snyk
added 2026/06/01 9:35 p.m.13 views

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via improper handling of user roles in the api process. An attacker can gain unauthorized administrative privileges by sending crafted requests after authenticating as a regular user. Remediation Upgrade...

8.8CVSS5.8AI score0.00437EPSS
SaveExploits0References3
NVD
NVD
added 2026/06/01 9:16 p.m.26 views

CVE-2026-10288

A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function passwordverify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper authentication. It is possible to launch...

7.5CVSS0.00496EPSS
SaveExploits0References6
CVE
CVE
added 2026/06/01 9:2 p.m.34 views

CVE-2026-40964

Cloud Foundry Foundation reports an Authentication Bypass in cf-auth-proxy that permits an unauthenticated remote attacker to read all logs and metrics for all apps and platform components by minting a JWT accepted as a valid logs.admin token. Affected: log-cache_release up to v3.2.6 (inclusive);...

7.5CVSS5.8AI score0.00393EPSS
SaveExploits0References1
Rows per page
Query Builder