1253470 matches found
PT-2026-83540
Name of the Vulnerable Software and Affected Versions Beetel 450TC3 version 01.00.00 01 Description An issue exists within the User Management component where the manipulation of the Username argument allows for remote cross site scripting. Cross site scripting is a technique where malicious...
Debian dsa-6479 : roundcube - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6479 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6479-1 [email protected] https://www.debian.org/securit...
PT-2026-83548
Incorrect Authorization vulnerability in ash-project ash sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.different queries?/2 report...
PT-2026-83549
Name of the Vulnerable Software and Affected Versions ash sql versions 0.1.0 through 0.7.0 Description An incorrect authorization issue exists in schema-based multitenant applications. When an aggregate is computed over a distinct query, the function add single aggs rebuilds the outer query using...
PT-2026-83585
Summary Unchecked Return Value vulnerability in ash-project ash postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...
PT-2026-83553
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...
CVE-2026-82483: Improper Neutralization of Input During Web Page Generation
A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file dbinput.php of the component Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit is n...
PT-2026-83530
Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.6.29 Description A remote cross site scripting issue exists within the Hidden Album Update Endpoint in the db input.php file. Cross site scripting is a technique where malicious scripts are injected...
[SECURITY] [DLA 4760-1] roundcube security update
Debian LTS Advisory DLA-4760-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 29, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.4.15+dfsg.1-1+deb11u11 1.6.5+dfsg-1+deb12u11 CVE ID : CVE-2026-74997 CVE-2026-74998 CVE-2026-74999...
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
CVE-2026-82468
Rodauth versions before 2.47.0 contain a cross-site request forgery (CSRF) protection bypass in the JSON request content type validation. An attacker can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation, forcing victims to aut...
CVE-2026-82468 Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
CVE-2026-82451
Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...
Exploit for CVE-2026-68929
CVE-2026-68929 — FastGPT WeChat Channel Hijack PoC Unauthenti...
CVE-2026-17522
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability
Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.42...
WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.5 - Cross-Customer Subscription Cancellation vulnerability
Cross-Customer Subscription Cancellation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Full Stripe Free versions 8.5.5...
CVE-2026-80311
The Stripe Payment Forms by WP Full Pay WordPress plugin, in versions before 8.5.5 , is vulnerable to a cross-customer subscription cancellation via an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a subscription belongs to the customer associated with the active custome...
WordPress User Profile Builder plugin < 4.0.1 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Profile Builder versions 4.0.1...