CVE-2026-102578

A SQL injection vulnerability exists in the Moodle learning management system. An authenticated attacker who has access to the question bank web service can submit unsanitized input that is directly processed into database queries. This flaw allows the attacker to view, alter, or delete sensitive...

EUVD-2026-89717

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2024-8465-PoC

CVE-2024-8465 – SQL Injection Proof of Concept Team Information Team Name: The Misfits Team Members: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Overview This repository contains a vulnerable web application created as a Proof of Concept PoC to demonstrate an SQL...

CVE-2026-97985

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by triggering an infinite busy-wait loop on the system. When processing local Unix domain sockets AFUNIX containing out-of-band OOB data, the kernel fails to update internal queue markers during certain receive...

CVE-2026-14876

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-89671

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-16596

The WP Directory Kit plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 1.5.4 . The root cause is insufficient escaping of the user-supplied data_fields_list parameter combined with a lack of sufficient preparation on the existing SQL query. This vul...

EUVD-2026-89666

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-89667

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-14876 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-14876

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.5.1.38 . The root cause is insufficient input sanitization and output escaping involving the 'data-href' parameter. This flaw allows authenticated attackers with contri...

CVE-2026-14876 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

LocalExifGeoMap

Local Exif Geo Map 📍 A powerful, privacy-focused, browser-based tool to visualize and analyze GPS data from your photos. Simply drag and drop images to generate interactive maps, heatmaps, elevation profiles, and trip statistics. Why? I've always wanted a self-hosted tool to analyze my photos and...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed in the Vulnerability Details section below. This bulletin provides information about the affected components and the remediation for these...

CVE-2025-62950-PoC

Descripción Esta prueba de concepto PoC describe una vulnerabilidad de falsificación de solicitudes entre sitios Cross-Site Request Forgery, CSRF encontrada en el plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. El problema permite a un atacante engañar a un usuario...

CVE-2026-96886

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

CVE-2026-83560

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...