18264 matches found
WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion
The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute...
WordPress Simple Job Board - Unauthorized Data Access
The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...
Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection
Team WordPress plugin = 5.0.11 contains a SQL injection caused by improper sanitization and escaping of a parameter in an AJAX action accessible to unauthenticated users, letting remote attackers execute arbitrary SQL commands. id: CVE-2025-14124 info: name: Team WordPress Plugin TLP Team = 5.0.9...
GeoServer Demo Request Endpoint - Server Side Request Forgery
It is possible to achieve Server Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to...
Easy!Appointments <1.4.3 - Broken Access Control
Easy!Appointments prior to 1.4.3 allows exposure of Private Personal Information to an unauthorized actor via the GitHub repository alextselegidis/easyappointments. id: CVE-2022-0482 info: name: Easy!Appointments 1.4.3 - Broken Access Control author: francescocarlucci,opencirt severity: critical...
NextGen Healthcare Mirth Connect - Remote Code Execution
Unauthenticated remote code execution vulnerability in NextGen Healthcare Mirth Connect before version 4.4.1. id: CVE-2023-43208 info: name: NextGen Healthcare Mirth Connect - Remote Code Execution author: princechaddha severity: critical description: Unauthenticated remote code execution...
Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
The Oracle Applications Framework component of Oracle E-Business Suite subcomponent: Popup windows lists of values, datepicker, etc. is impacted by open redirect issues in versions 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers...
CVE-2026-19680
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...
EUVD-2026-58743
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...
CVE-2026-19680 SQL Injection
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...
CVE-2026-19680
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...
CVE-2026-19870
Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create...
EUVD-2026-58503
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
EUVD-2026-58479
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, POST /api/v1/runs/:runParam/replay in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses prisma.taskRun.findUnique where: friendlyId: runParam without a...
SUSE-SU-2026:3615-1 Security update for java-1_8_0-ibm
This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIMD evaluator bsc1274275. - CVE-2026-16439: using -Xtrace to trace method arguments can lead to...
CVE-2026-73344
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
EUVD-2026-57924
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...
EUVD-2026-57910
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
