CVE-2026-103588

QloApps versions through 1.7.0 are susceptible to a reflected cross-site scripting (XSS) vulnerability located in the exceptions field of the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload within the exceptions parameter . If an authen...

CentOS Linux 7 [TuxCare] Security Update: openldap / openldap-clients / openldap-devel / openldap-servers / etc Multiple Vulnerabilities (CENTOS7:CLSA-2023:1695834945)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1695834945 advisory. - In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck...

CVE-2022-46638

CVE-2022-46638 150개 이상의 국가에서 1억 명 이상의 사용자가 신뢰하는 인기 Android 앱인 AppLock Ver.5.6.2의 취약점에 관한 내용입니다. PoC 뒤로 가기 버튼을 여러 번 누르기만 하면 AppLock으로 보호되는 애플리케이션의 잠금을 해제할 수 있습니다. 1. AppLock에 의해 잠긴 애플리케이션을 엽니다. 2. PIN/비밀번호를 입력하지 마세요. 3. 뒤로 가기 버튼을 탭/클릭하고, 광고를 본 다음 광고를 닫습니다. 4. 13단계를 여러 번 반복합니다. 5. Boom! ☺ AppLock으로...

EUVD-2026-88580

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2022-42475

CVE-2022-42475 배경 이것은 블로그 게시물https://bishopfox.com/blog/exploit-cve-2022-42475에 대한 익스플로잇입니다. 수정 버전 이 익스플로잇 버전은 해커가 ROP 가젯 등에 필요한 메모리 주소를 직접 제공하지 않으면 작동하지 않습니다. 이러한 데이터를 결정하는 작업은 Bishop Fox의 기밀 및 독점 정보이며, 이 익스플로잇과 함께 게시할 수 없습니다게시하지 않을 것입니다. 이해해 주시기 바랍니다! 작동 모드 검증 전용, 익스플로잇 없음. 취약한지 확인. 페이로드 없음, 셸코...

CVE-2026-77874 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

CVE-2026-77874

IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1) is vulnerable to SQL injection within the Hibernate component. A remote unauthenticated attacker can send specially crafted SQL statements, potentially allowing them to view, add, modify, or delete...

CVE-2026-77874 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

CVE-2026-77874: Improper Neutralization of Special Elements used in an SQL Command

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

EUVD-2026-83724

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible...

CVE-2026-94104

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint (filemanager.php). The root cause is a failure to validate file extensions for new filenames or when the chunks parameter is 2 or higher. An attacker with view-only back-office access can u...

PT-2026-95955

Name of the Vulnerable Software and Affected Versions NivoCart versions prior to 2.4.1 Description An arbitrary file upload flaw exists in the File Manager multi endpoint. The system fails to validate file extensions for new filenames or when the chunks parameter is set to 2 or higher. This allow...

CVE-2026-93988: Improper Limitation of a Pathname to a Restricted Directory

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

PT-2026-95741

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.9 Description The Tutor LMS plugin for WordPress contains a Reflected Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject...

PT-2026-95872

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description Authenticated back-office users can read arbitrary files due to a path traversal issue in the getEmailHTML action of the 'admin/ajax.php' endpoint. By providing relative path sequences in the email...

CVE-2026-17619

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-17619 The IBM Platform RTM is affected by an SQL injection vulnerability

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-17619 The IBM Platform RTM is affected by an SQL injection vulnerability

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-17619

IBM Platform RTM (spectrum-lsf) versions 10.2.0.15 and 10.2.0.16 are affected by a SQL injection vulnerability (CWE-89). The application accepts user input directly in a web interface for SQL queries without adequate validation, allowing a remote attacker to send specially crafted SQL statements ...