16834 matches found
EUVD-2026-34285
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose configUpdate as a state-changing administrator endpoint, but the route does not enforce POST and does not use any anti-CSRF token. In the default form and JWT-based authentication mode,...
CVE-2026-43985 Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose configUpdate as a state-changing administrator endpoint, but the route does not enforce POST and does not use any anti-CSRF token. In the default form and JWT-based authentication mode,...
CVE-2026-43985
Tautulli (Python-based Plex monitoring) before v2.17.1 exposes the admin-changing endpoint /configUpdate without enforcing POST or anti-CSRF checks. In default form/JWT modes, the SameSite=Lax cookie permits top-level cross-site requests, enabling an attacker to coerce a logged-in admin to submit...
EUVD-2019-20163
WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=exportcsv and a malicious path paramet...
CVE-2026-50206 VPN Command Injection Vulnerability
Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files...
CVE-2026-50206
Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files...
CVE-2026-50206
CVE-2026-50206 affects VPN network profile handling where special characters in config files are not safely processed, enabling command injection. Root cause: improper sanitization or parsing of config entries leads to execution of injected commands when reading malicious config files. Documented...
CVE-2026-50206 VPN Command Injection Vulnerability
Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files...
CVE-2026-10805
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description MUD URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,...
Exploit for CVE-2026-42945
nginx-rift-scanner Dependency-free Python 3 scanner for CVE...
PT-2026-46198
Name of the Vulnerable Software and Affected Versions Care2x version 2.7 Description Multiple SQL injection flaws allow unauthenticated attackers to execute arbitrary SQL commands. This is achieved by manipulating the ck config cookie parameter across several endpoints, including 'login.php',...
PT-2026-55774
Name of the Vulnerable Software and Affected Versions UTT HiPER 1250GW versions prior to 3.2.7-210907-180535 Description A stack-based buffer overflow exists in the Web Endpoint component. This occurs when the /goform/ConfigWirelessBase 5g endpoint processes the ssid argument, allowing a remote...
Linux Distros Unpatched Vulnerability : CVE-2026-44281
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config RE...
Notepad++ < 8.9.6.1 Multiple Vulnerabilities
The version of Notepad++ installed on the remote host is prior to 8.9.6.1. It is, therefore, affected by multiple vulnerabilities: - A crash caused by any malformed structure that could allow an attacker to cause a denial of service condition. CVE-2026-48770 - An arbitrary code execution...
CVE-2026-50206: Improper Neutralization of Special Elements used in an OS Command
Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files...
CVE-2026-10777
A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The...
CVE-2026-10777 ealpha072 Student-Management-System Administrative Backend config.php improper authentication
A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The...
CVE-2026-10777
A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The...
CVE-2026-10777 ealpha072 Student-Management-System Administrative Backend config.php improper authentication
A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The...