31549 matches found
Webkul Software Bagisto 访问控制错误漏洞
Webkul Software Bagisto is an open source e-commerce framework from Webkul Software, India. An access control error vulnerability exists in Webkul Software Bagisto versions prior to 2.3.10, which stems from an API route that remains active after installation and does not require authentication,...
PT-2026-1073
Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.2.7.3256 build 20250913 QNAP QuTS hero h5.2.7 versions prior to 5.2.7.3256 build 20250913 QNAP QuTS hero h5.3.1 versions prior to 5.3.1.3250 build 20250912 Description A NULL pointer dereference issue exists in...
PT-2026-1100
Name of the Vulnerable Software and Affected Versions QNAP versions prior to 5.2.8.3332 build 20251128 Description A buffer overflow issue exists in QNAP operating system. A remote attacker gaining administrator access can exploit this to modify memory or cause processes to crash. Recommendations...
PT-2026-1080
Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.7.3256 build 20250913 QNAP versions prior to QuTS hero h5.2.7.3256 build 20250913 QNAP versions prior to QuTS hero h5.3.1.3250 build 20250912 Description A NULL pointer dereference issue exists in QNAP operating...
PT-2026-1096
Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.8.3332 build 20251128 QNAP versions prior to QuTS hero h5.2.8.3321 build 20251117 Description A path traversal issue exists in QNAP operating systems. A remote attacker with administrator privileges can potential...
Plane 访问控制错误漏洞
Plane is an open source, self-hosted project planning tool from Plane Open Source. An access control error vulnerability exists in versions of Plane prior to 1.2.0, which stems from a guest user being able to access a list of members of a specific workspace and recognize an administrator's email...
PT-2026-1119
Name of the Vulnerable Software and Affected Versions Emlog version 2.5.23 Description Emlog, an open source website building system, contains a stored cross-site scripting issue. This can allow for account takeover, including administrative accounts. As of the time of publication, no patched...
PT-2026-1079
Name of the Vulnerable Software and Affected Versions QNAP versions prior to 5.2.7.3256 build 20250913 QNAP QuTS hero versions prior to 5.2.7.3256 build 20250913 QNAP QuTS hero versions prior to 5.3.1.3250 build 20250912 Description A NULL pointer dereference issue exists in QNAP operating system...
PT-2026-1041
Name of the Vulnerable Software and Affected Versions Branda plugin for WordPress versions through 3.4.24 Description The Branda plugin for WordPress is susceptible to privilege escalation through account takeover. This occurs because the plugin does not correctly verify a user’s identity before...
PT-2026-1089
Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.7.3256 build 20250913 QNAP versions prior to QuTS hero h5.2.7.3256 build 20250913 QNAP versions prior to QuTS hero h5.3.1.3250 build 20250912 Description A resource allocation issue exists in QNAP operating...
PT-2026-1088
Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.7.3256 build 20250913 QNAP versions prior to QuTS hero h5.2.7.3256 build 20250913 QNAP versions prior to QuTS hero h5.3.1.3250 build 20250912 Description An out-of-bounds read issue exists in QNAP NAS operating...
PT-2026-1095
Name of the Vulnerable Software and Affected Versions License Center versions prior to 2.0.36 Description A buffer overflow issue exists in License Center. Successful exploitation could allow a remote attacker with administrator privileges to modify memory or cause processes to crash...
PT-2026-1084
Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.7.3256 build 20250913 QNAP versions prior to QuTS hero h5.2.7.3256 build 20250913 QNAP versions prior to QuTS hero h5.3.1.3250 build 20250912 Description A buffer overflow condition exists in QNAP operating...
CVE-2025-68619 Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugi...
Apache StreamPipes has Improper Privilege Management issue
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...
CVE-2025-47411
CVE-2025-47411 affects Apache StreamPipes up to version 0.97.0. A non-administrator user can exploit a flaw in the user ID creation mechanism to swap a real user’s username with an administrator’s, enabling privilege escalation by manipulating JWT tokens. Reported impact includes administrative c...
CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...
WordPress Accessibility Press plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by HunSec in WordPress Plugin Accessibility Press versions = 1.0.2...
WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Tran Tuan Dung domiee13 in WordPress Plugin Behance Portfolio Manager versions = 1.7.5...