54521 matches found
CVE-2026-85382: Improper Neutralization of Input During Web Page Generation
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a...
CVE-2026-85379: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterModel::searchChapter of the file App/Home/Controller/ChapterController.class.php of the component Query Builder. The manipulatio...
PT-2026-85317
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterModel::searchChapter of the file App/Home/Controller/ChapterController.class.php of the component Query Builder. The manipulatio...
PT-2026-86162
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User Model::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...
...[ More ]
Flextype CMS version 1.0.0-alpha.3 contains a stored server-side request forgery SSRF vulnerability in its shortcode-processing functionality. Attacker-controlled entry fields can be automatically processed by Flextype's shortcode parser. The built-in fetch shortcode accepts an attacker-controlle...
PT-2026-85332
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such...
CVE-2026-85378
A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...
CVE-2026-85378 light0011 cms Chapter Controller ChapterController.class.php _initialize authorization
A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...
CVE-2026-85378 light0011 cms Chapter Controller ChapterController.class.php _initialize authorization
A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...
CVE-2026-85378
light0011 cms contains an authorization bypass in the Chapter Controller component, specifically in the function AuthController::_initialize within the file App/Admin/Controller/ChapterController.class.php . The flaw allows a remote, unauthenticated attacker to bypass access controls with low com...
CVE-2026-85378 light0011 cms Chapter Controller ChapterController.class.php _initialize authorization
A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...
CVE-2026-63669
creationtimestamp| type| source ---|---|--- 2026-09-03 22:35:23+00:00| published-proof-of-concept| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh...
CVE-2026-63670
creationtimestamp| type| source ---|---|--- 2026-09-03 22:35:20+00:00| published-proof-of-concept| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw...
USN-8720-1: GnuPG vulnerability
It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks...
USN-8720-1 gnupg2 vulnerability
It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks...
Ghost CMS Remote Code Execution (CVE-2026-29053)
Exploits CVE-2026-29053 in Ghost CMS 0.7.2–6.19.0: a malicious theme template abuses Handlebars get filter parsing to reach Node.js childprocess.exec. Requires Ghost Admin access password, API key, session cookie, session secret, or invite flow. Versions 5.105.0–5.130.5 and 6.0.0–6.10.3 also...
CLSA-2026-1788430341 TuxCare security update for craftcms/cms (4 CVEs)
TuxCare rebuilt craftcms/cms to address 4 CVEs. Fixed in 3.9.15-p9+tuxcare...
Bludit CMS 3.20.0 Cross Site Scripting
Bludit CMS version 3.20.0 suffers from a cross site scripting vulnerability in the search plugin. Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting Date: 2026-08-11 Exploit Author: Ranjit Kumar Singh Vendor Homepage: https://www.bludit.com/ Software Link:...
PT-2026-85315
A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController:: initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. T...