765 matches found
CVE-2023-0156
CVE ID : CVE-2023-0156 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...
CVE-2026-97627
Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands...
CVE-2026-100737
Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware...
EUVD-2026-104798
Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands...
CVE-2026-97627
Multiple Digital Video Recorders (DVRs) provided by Atsumi Electric Co., Ltd. are affected by a hidden functionality issue. An attacker with administrator privileges can exploit this vulnerability to execute arbitrary OS commands . No specific software versions, root cause files, or remediation s...
CVE-2026-97627
Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands...
EUVD-2026-104797
Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware...
CVE-2026-100737
A hidden functionality issue exists in multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. An attacker with administrator privileges can exploit this flaw to upgrade the affected devices to unauthorized firmware . The vulnerability is characterized by a Medium severity (...
CVE-2026-100737
Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware...
PT-2026-92149
Name of the Vulnerable Software and Affected Versions IBM Verify Identity Access affected versions not specified Description Improper validation of user supplied requests may allow an administrator to execute commands beyond their authorized permissions. Recommendations At the moment, there is no...
CVE-2026-77753 Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...
CVE-2026-26212
The Rara One Click Demo Import WordPress plugin before version 1.3.5 contains an arbitrary file upload vulnerability. Authenticated attackers with Administrator privileges can pass a false value to wp_handle_upload() , disabling WordPress core's file type validation across all three file paramete...
CVE-2026-84113: Improper Neutralization of Special Elements used in an SQL Command
The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...
CVE-2026-22575
An improper access control vulnerability in Fortinet FortiManager and FortiManager Cloud allows a privileged administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests. Affected versions include FortiManager 7.6.0–7.6.4, 7.4.0–7.4.10, and 7.2 (all versio...
EUVD-2026-70909
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-76178 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...
CVE-2025-15692 Icegram Express < 5.8.6 - Admin+ Stored XSS
The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-14325 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...
CVE-2026-18430
HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...