CVE-2025-1106

A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletediraction/restoreaction in the library lib/admin/databaseadmin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to...

CVE-2025-1393

An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product...

CVE-2025-15479: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS, CWE-79 in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms on Windows and Linux servers allows authenticated remote users with survey creation or edit privileges to execute...

CVE-2025-12519

Missing Authorization vulnerability in Centreon Infra Monitoring Administration parameters API endpoint modules allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. This issue affects Infra Monitoring...

Template Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Template Injection via the map filter in Twig templates when processing text fields that accept Twig input in the control panel settings or through the System Messages utility. An attacker ca...

CVE-2026-0589

A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be us...

CVE-2026-0589

A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be us...

CVE-2026-0589

The CVE-2026-0589 entry concerns code-projects Online Product Reservation System 1.0, specifically the Administration Backend. The documented issue is improper authentication within an unknown function of the Admin Backend that can be triggered remotely. Public exploit information exists, with ex...

CVE-2026-0589 code-projects Online Product Reservation System Administration Backend improper authentication

A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be us...

EUVD-2026-0856

A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be us...

CVE-2025-12519

Missing Authorization vulnerability in Centreon Infra Monitoring Administration parameters API endpoint modules allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. This issue affects Infra Monitoring...

CVE-2025-12519 Information disclosure on Administration parameters API endpoint

Missing Authorization vulnerability in Centreon Infra Monitoring Administration parameters API endpoint modules allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. This issue affects Infra Monitoring...

EUVD-2026-0871

Missing Authorization vulnerability in Centreon Infra Monitoring Administration parameters API endpoint modules allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. This issue affects Infra Monitoring...

CVE-2025-12519 Information disclosure on Administration parameters API endpoint

Missing Authorization vulnerability in Centreon Infra Monitoring Administration parameters API endpoint modules allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. This issue affects Infra Monitoring...

CVE-2025-12519

CVE-2025-12519 involves a Missing Authorization vulnerability in Centreon Infra Monitoring, affecting the Administration parameters API endpoint modules. This allows information disclosure due to ACLs not properly constraining access. Affected versions: 25.10.0–25.10.2, 24.10.0–24.10.15, 24.04.0–...

CVE-2025-12519 Information disclosure on Administration parameters API endpoint

Missing Authorization vulnerability in Centreon Infra Monitoring Administration parameters API endpoint modules allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. This issue affects Infra Monitoring...

CVE-2025-13056 A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Administration ACL menu configuration modules allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, fro...

CVE-2025-13056 A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Administration ACL menu configuration modules allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, fro...

CVE-2025-13056

Summary: CVE-2025-13056 is a stored XSS vulnerability in Centreon Infra Monitoring, specifically in the Administration ACL menu configuration modules . The issue arises from ** Improper Neutralization of Input During Web Page Generation**, allowing stored scripts to execute in the context of user...

CVE-2025-5965 RCE via the backup feature available only to user with high privilege

In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Centreon Infra Monitoring Backup configuration in the administration setup...