PT-2026-5850

VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path. Attackers can exploit the unquoted path in 'C:Program Files x86VPN Unlimited' to replace the service executable and gain elevated system...

CVE-2025-61506

An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint...

GUnet OpenEclass SQL注入漏洞

GUnet OpenEclass is a learning management system developed by the Greek company GUnet. Version 1.7.3 of GUnet OpenEclass contains a SQL injection vulnerability. This vulnerability stems from multiple SQL injection points in the agenda module and other endpoints, which could allow authenticated...

Broadcom Brocade Fabric OS 安全漏洞

Broadcom Brocade Fabric OS is an embedded operating system used in switches and routers by Broadcom Corporation. There is a security vulnerability in Broadcom Brocade Fabric OS. This vulnerability stems from local attackers with access to the Bash shell being able to access the content of...

PT-2026-5847

Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with...

PT-2026-5798

Name of the Vulnerable Software and Affected Versions AnyDesk version 5.4.0 Description AnyDesk 5.4.0 has an issue with an unquoted service path in its Windows service configuration. This could allow local attackers to inject malicious executables. Exploiting the unquoted binary path enables...

PT-2026-6306

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.81 Description FacturaScripts is enterprise resource planning and accounting software. Versions prior to 2025.81 contain a critical SQL injection issue in the autocomplete functionality. Authenticated...

PT-2026-6348

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access...

Qwik 安全漏洞

Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.19.0 contained security vulnerabilities. These vulnerabilities stemmed from a prototype pollution vulnerability in the formToObj function, which could allow unauthenticated attackers to contaminate Object.prototype,...

FUXA 安全漏洞

FUXA is a web-based process visualization software developed by frangoteam. Version 1.2.7 of FUXA contains a security vulnerability. This vulnerability stems from the lack of an authentication mechanism for the/api/upload API endpoints. This allows unauthorized remote attackers to upload arbitrar...

CVE-2025-70758

The chetans9 core-php-admin-panel (through commit a94a780d6 ) contains an authentication bypass vulnerability in the includes/auth_validate.php file. The root cause is that the application issues an HTTP redirect via header(Location:login.php) when a user is unauthenticated but fails to invoke th...

CVE-2025-69981

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files such as the SQLite user...

Core PHP Admin panel 安全漏洞

Core PHP Admin Panel is a management panel developed by Chetan Shenai. There is a security vulnerability in Core PHP Admin Panel, which stems from an authentication bypass in the includes/authvalidate.php file. This vulnerability could allow unauthenticated remote attackers to access protected...

CVE-2026-22221

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2vpn modules allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity...

CVE-2026-22223

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2vpn modules allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity...

Plikli CMS 4.0.0 Blind SQL Injection

A blind SQL injection vulnerability exists in Plikli CMS version 4.0.0. The vulnerability allows remote attackers to execute arbitrary SQL commands and potentially compromise the database. This is older research added to the archive...

SOPlanning 1.41 SQL Injection

A SQL injection vulnerability exists in SOPlanning version 1.41. The vulnerability allows remote attackers to execute arbitrary SQL commands and potentially compromise the database. This issue is older research added to the archive...

phpMemAdmin Cross Site Scripting

A cross site scripting vulnerability exists in phpMemAdmin. The vulnerability allows remote attackers to inject arbitrary web script or HTML. This issue is older research added to the archive...

ElkArte 1.1.0 Cross Site Scripting

A cross site scripting vulnerability exists in ElkArte Forum version 1.1.0. The vulnerability allows remote attackers to inject arbitrary web script or HTML. This issue is older research added to the archive...

WordPress Twenty Fifteen Theme DOM Cross Site Scripting

A DOM-based cross site scripting vulnerability exists in the WordPress Twenty Fifteen Theme. The vulnerability allows remote attackers to inject arbitrary web script or HTML via DOM manipulation. This issue is older research added to the archive...