CVE-2026-85157

WWBN AVideo is affected by a broken access control vulnerability in the unauthenticated feed/index.php (RSS feed) endpoint. When a program_id parameter is supplied, per-video visibility checks are disabled, allowing unauthenticated attackers to enumerate playlist identifiers and retrieve unlisted...

CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

CVE-2026-85155

WWBN AVideo is vulnerable to SQL injection in the sort column parameter of the get.json.php endpoint when APIName=channels. An unauthenticated attacker can order results by arbitrary database columns such as users.password and users.recoverPass, enabling an ordering oracle to infer password hash ...

EUVD-2026-70390

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...

CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...

CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...

CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...

PyMemoryEditor v2.2.0

PyMemoryEditor A pure-Python library built on ctypes that lets you inspect, modify and search the memory of any running process in a few lines of Python — Cheat Engine workflows on Windows, Linux and macOS! Read, write and scan the memory of any process — straight from Python. One unified API...

CVE-2025-66850

Finding Within the ‘LibreNMS’ application, we discovered a reflected Cross-Site Scripting vulnerability; this vulnerability exists in the routing module’s protocol parameter, allowing an attacker to render malicious JavaScript in a victim’s browser. This vulnerability affects all versions from...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-5450 DESCRIPTION: Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to version 2.43 with a format wid...

Exploit for CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File...

terminalphone — Updated!

TerminalPhone Encrypted push-to-talk voice communication over Tor hidden services. TerminalPhone is a single, self-contained Bash script that provides anonymous, end-to-end encrypted voice and text communication between two or more parties over the Tor network. It operates as a walkie-talkie: you...

Exploit for CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar...

EUVD-2026-70371

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76176 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76176

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76176 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76176

CVE-2026-76176 is a SQL injection vulnerability in Ocsreports for OCS Inventory NG , located in the endpoint /ocsreports/index.php?function=admin_double. The root cause is improper processing of values in the ID field of the selected_grp_dupli[] parameter. An authenticated user with operator priv...