WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Themify Builder versions = 7.8.1...

EUVD-2026-88051

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-100887

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-101144: Improper Access Control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2026-100887: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

PT-2026-102344

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software version 9.7.0 Description Improper access controls exist within the Query Builder component, specifically affecting the '/callrec/searchAction.do' endpoint. This flaw allows for remote exploitation. Recommendatio...

CVE-2026-100887 amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-100887 amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-100887

A SQL injection vulnerability exists in the Database Query Builder component of the amirsanni Mini-Inventory-and-Sales-Management-System (versions up to 81bf0b55f5933f3b0dbb1583204a612e06605b95 ). The flaw is located in the order_by function within the DB_query_builder.php file, where manipulatio...

Exploit for CVE-2026-76547

CVE-2026-76547 — PHP Object Injection in Profile Builder Add-...

Exploit for CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated...

PT-2026-99728

Name of the Vulnerable Software and Affected Versions amirsanni Mini-Inventory-and-Sales-Management-System versions up to 81bf0b55f5933f3b0dbb1583204a612e06605b95 Description A security flaw in the Database Query Builder component allows remote exploitation via SQL injection. The issue occurs whe...

CVE-2026-72668

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

EUVD-2026-87792

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

CVE-2026-72668

Kibana versions 9.4.0 through 9.4.6 are vulnerable to a Confused Deputy (CWE-441) flaw in the Agent Builder component. An authenticated non-administrative user with both Agent Builder and Workflows privileges can manipulate a shared agent to perform privileged operations under the identity of a h...

CVE-2024-25600-EXPLOIT

CVE-2024-25600 - WordPress Bricks Builder 远程代码执行 RCE 🌐 WordPress 的 Bricks 主题被确认存在一个关键安全漏洞，编号为 CVE-2024-25600。该漏洞影响 Bricks Builder 插件的所有版本（包括 1.9.6）。此漏洞构成重大风险，因为它允许未经身份验证的攻击者在托管存在漏洞的 WordPress 网站的服务器上远程执行任意代码。CVE-2024-25600 属于远程代码执行 RCE 漏洞，使攻击者能够在无需任何身份验证的情况下操纵服务器执行恶意代码。该漏洞利用了 Bricks Builder...

CVE-2026-100687

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100682

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...