CVE-2021-42261

CVE-2021-42261 Descrizione suggerita Revisor Video Management System VMS precedente alla versione 2.0.0 presenta una vulnerabilità di directory traversal. Uno sfruttamento riuscito potrebbe consentire a un attaccante di attraversare il file system per accedere a file o directory che si trovano al...

CVE-2026-76798

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-82258 SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests...

SEDATED

Il progetto SEDATED® Sensitive Enterprise Data Analyzer To Eliminate Disclosure si concentra sulla prevenzione della trasmissione a Git di dati sensibili come credenziali utente e token. Indice dei contenuti Scopo Configurazione Clona SEDATED® Aggiorna i file .example Personalizza variabili e...

CVE-2022-0236

CVE-2022-0236 Das WP Import Export WordPress Plugin ist anfällig für die Offenlegung sensibler Daten ohne Authentifizierung, da eine fehlende Berechtigungsprüfung in der Download-Funktion wpieprocessfiledownload in der Datei /includes/classes/class-wpie-general.php vorhanden ist. Dies ermöglichte...

CVE-2026-81335

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

CVE-2026-81335 Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

CVE-2026-81335

Baserow before 2.3.1 is vulnerable to unauthenticated data disclosure via its Application Builder data sources. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py use a permission class that admits any caller, and DataSourceService.dispatch_data_so...

CVE-2026-81335 Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

CVE-2026-79676

A flaw was found in NLTK. This path traversal vulnerability allows attackers to bypass security measures by using symbolic links within trusted data roots. By staging specially crafted symlinked corpus files, an attacker can disclose sensitive information from outside the intended data directorie...

CVE-2026-71084

A flaw was found in mysql-connector-odbc. An unauthenticated attacker with local logon access to the infrastructure where MySQL Connectors executes can exploit this vulnerability. This can lead to a complete denial of service DoS by causing the component to crash repeatedly. Additionally, the...

WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability

Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability discovered by ryan fabella in WordPress Plugin MultiVendorX versions 5.0.11...

WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...

CVE-2026-16568 ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

CVE-2026-16568

This is an IDOR (Insecure Direct Object Reference) vulnerability in The Mobile App for WooCommerce: ShopApper WordPress plugin. A REST endpoint fails to verify that the requesting user owns the customer profile being queried, allowing any authenticated Subscriber+ user to retrieve other users' pe...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS एंडपॉइंट XXE हमले के लिए असुरक्षित 🌟 🏷️ मूलभूत जानकारी CVE ID : CVE-2025-58360 प्रकाशित : 📅 25 नवंबर, 2025 अंतिम संशोधित : 📅 25 नवंबर, 2025 अभी भी ताज़ा, 26 नवंबर तक भेद्यता प्रकार : XML बाहरी इकाई XXE – CWE-611 प्रभावित सॉफ़्टवेयर : GeoServer Java में लिखा गया...

TheMisfits-CVE-2024-8465-SQLi

CVE-2024-8465 – Prova de Conceito de Injeção SQL Informações da Equipe Nome da Equipe: The Misfits Membros da Equipe: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Visão Geral Este repositório contém uma aplicação web vulnerável criada como Prova de Conceito PoC para...

CVE-2024-8465-PoC

CVE-2024-8465 – Prova di Concetto di SQL Injection Informazioni sul Team Nome del Team: The Misfits Membri del Team: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Panoramica Questo repository contiene un'applicazione web vulnerabile creata come Prova di Concetto PoC per...