11181 matches found
CVE-2026-0713
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-0635
The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'respaccordionsildersaveimages' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with...
PT-2026-3003
Name of the Vulnerable Software and Affected Versions Supreme Modules Lite versions prior to 2.5.63 Description The Supreme Modules Lite plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation. The plugin incorrectly identifies JSON files, permitting...
CVE-2025-67084
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution RCE...
CVE-2025-67084
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution RCE...
CVE-2025-67077
CVE-2025-67077 describes a file upload vulnerability in the Omnispace Agora Project before 25.10, reachable via the UploadTmpFile action. The issue affects authenticated users and, under some conditions, guest users, enabling file upload through that endpoint. The Red Hat/NVD/CIRCLOSV and PT-2026...
CVE-2025-67084
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution RCE...
CVE-2025-67077
File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action...
CVE-2025-67084
The CVE-2025-67084 entry concerns InvoicePlane up to version 1.6.3, where an authenticated file-upload flaw allows uploading arbitrary PHP files into attachments, enabling remote code execution (RCE). Affected component is the file upload handling in attachments; the root cause is not explicitly ...
PT-2026-3034
Name of the Vulnerable Software and Affected Versions Chikitsa Patient Management System version 2.0.2 Description The software contains an authenticated remote code execution issue. Attackers can upload malicious PHP plugins through the module upload functionality. Authenticated attackers can...
PT-2026-3033
Name of the Vulnerable Software and Affected Versions Chikitsa Patient Management System version 2.0.2 Description The software contains an authenticated remote code execution issue in the backup restoration functionality. An authenticated attacker can upload a modified backup zip file containing...
PT-2026-3160
Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.13.0 Description WebsiteBaker version 2.13.0 has a flaw that permits authenticated users with language editing rights to execute code remotely. This is possible through manipulation of parameters within the language...
CVE-2025-67082
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database...
PT-2026-3042
Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that allows attackers to manipulate database queries. Attackers can exploit this vulnerability using boolean-based, error-based, and time-based blind SQL injection techniques to...
Chikitsa code vulnerabilities
Chikitsa is a patient management system developed by the individuals at Sanskruti Technologies. Version Chikitsa 2.0.2 has code vulnerabilities; these vulnerabilities stem from the backup and recovery function, and could allow authenticated attackers to execute remote code...
CVE-2026-23478
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update. This vulnerability is fixed in...
CVE-2025-37175
Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary comman...
CVE-2025-37172
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating...
CVE-2025-37174
Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbitrary files and execute arbitrary...