CVE-2026-102258: Improper Neutralization of Input During Web Page Generation

Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...

CVE-2026-18031: Improper Authentication

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

Malicious code in clawdest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cf31ecc1ce2cf9d018d5ea73c9ee8467f85efd2fda44d75dfd10797cb35778a2 The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...

CVE-2026-1729

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sbloginuserwithotpfun' function. This makes it possible for...

CVE-2025-14386

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the 'generatessourl' and 'validatessotoken' functions in versions 2.4.4 to 2.5.12. This makes it...

PT-2025-48555

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description Grav’s Admin plugin contains a flaw where the creation of new user accounts does not validate username uniqueness. This allows a user with create user permission to create an account with the sa...

CVE-2023-0444

A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' group, can view the password of another default user 'Administrator', which is in the 'Administrator' group. This allows any lower privilege...

PT-2024-31677

Name of the Vulnerable Software and Affected Versions: Social Login Lite For WooCommerce plugin for WordPress versions up to, and including, 1.6.0 Description: The issue is due to insufficient verification on the user being supplied during the social login through the plugin, making it possible f...

PT-2024-24121 · Yubico +1 · Yubico Ykman-Gui +2

Name of the Vulnerable Software and Affected Versions: Yubico ykman-gui aka YubiKey Manager GUI versions prior to 1.2.6 Description: A privilege escalation issue exists because browser windows can open as Administrator when Edge is not used on Windows systems. This could allow for unexpected...

PT-2024-12785 · Dell · Dell Supportassist

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist for Business PCs version 3.4.0 Description: The issue allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary...

CVE-2023-0444

A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' group, can view the password of another default user 'Administrator', which is in the 'Administrator' group. This allows any lower privilege...

CVE-2021-36621

Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could...

CVE-2021-31475

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF...

CVE-2021-22669

Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allow a low-privileged user to update an administrator’s password and login as an administrator to escalate privileges on the system...

Unspecified Vulnerability in TitanHQ WebTitan

TitanHQ WebTitan is a web content filter from TitanHQ Ireland. A security vulnerability exists in TitanHQ WebTitan versions prior to 5.18. The vulnerability can be exploited by an attacker to log in to the filter with administrator privileges using a hidden account...

London Trust Media Private Internet Access VPN Client for Windows Elevation of Privilege Vulnerability

London Trust Media Private Internet Access PIA VPN Client for Windows is a Windows-based VPN client for anonymous Internet access. A security vulnerability exists in version 77 of the London Trust Media PIA VPN Client for Windows based platforms, which stems from the program's failure to adequate...

Cisco IOS XE Software Override Access Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A security vulnerability exists in Cisco IOS XE Software version 16.x, which arises from the use of a default username and password for an account with level 15 privileges. A remote attacker could use this...

Loki - Scanner for Simple Indicators of Compromise

Simple IOC Scanner Detection is based on four detection methods: 1. File Name IOC Regex match on full file path/name 2. Yara Rule Check Yara signature match on file data and process memory 3. Hash check Compares known malicious hashes MD5, SHA1, SHA256 with scanned files The Windows binary is...

YAP 1.1.1 Blind SQL Injection/SQL Injection Vulnerabilities

No description provided by source. + YAP 1.1.1 Blind SQL Injection/SQL Injection + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + Blind SQL Injection The default prefix for database tables is "yap" .But can be changed at installation. PoC :...