CVE-2026-63339

The IXP Manager full-stack web application for managing Internet Exchange Points is vulnerable to a privilege escalation flaw in versions prior to 7.3.0 . An authenticated, non-administrative user can exploit improper input validation (CWE-20) and improper privilege management (CWE-269) to elevat...

Iku-soft Rdiffweb authorization issue vulnerability

The iKus-Soft RDiffWeb versions prior to 2.10.6 have a vulnerability related to authorization. This vulnerability stems from improper permission management in the user management API endpoint /api/users/usernameorid. Users who have been authenticated can elevate their permissions to administrator...

CVE-2026-68583

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...

Jellyfin Public Users - Exposure Detection

The Jellyfin media server exposed user information via the public users API endpoint. This endpoint could have leaked sensitive data including usernames, user IDs, server IDs, administrator status, password configuration, login activity, and user policies without authentication. !/usr/bin/env...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-101989)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. nspirational Quote Rotator plugin is a WordPress open source application plugin. WordPress Inspirational Quote...

AdCycle SQL Command Insertion Vulnerability - qDefense Advisory Number QDAV-2001-7-2

AdCycle SQL Command Insertion Vulnerability qDefense Advisory Number QDAV-2001-7-2 Product: AdCycle Vendor: AdCyle http://adcycle.com Severity: Remote; Attacker may gain AdCycle administrator status Versions Affected: Versions up to and including 1.15 Vendor Status: Vendor contacted; has released...

QDAV-2001-7-1

--=====================133743754==.ALT Content-Type: text/plain; charset="us-ascii"; format=flowed Multiple CGI Flat File Database Manipulation Vulnerability qDefense Advisory Number QDAV-2001-7-1 Product: Numerous CGI's Vendor: Numerous Vendors Severity: Remote; Severity varies, but can often be...