13136 matches found
CVE-2025-46204
説明 Unifiedtransform v2.0 は、不正確なアクセス制御（Incorrect Access Control）に対して脆弱です。任意のユーザー（学生および教師）が /course/edit/id エンドポイントを介してコースの詳細にアクセスし、変更することができます。この機能は管理専用を意図したものです。この欠陥を悪用すると、コース名やカテゴリの不正な操作が可能になり、データの整合性と管理統制が損なわれます。 ベンダー: Unifiedtransform 製品 学校管理ソフトウェア v2.0 影響を受けるコンポーネント コースの権限を担当するアクセス制御メカニズム。 ルー...
CVE-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...
CVE-2026-7176
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7175
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
EUVD-2026-90746
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7176
The Entradium platform by Crocantickets is vulnerable to a JavaScript injection flaw. Specifically, the Help text and Title parameters in the /events/-/custom_form/edit endpoint lack proper sanitization during the creation or modification of ticket sale forms. This allows an attacker to inject ma...
EUVD-2026-90745
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7175
The Entradium platform by Crocantickets is vulnerable to a script injection flaw in the My Profile section. Specifically, the Business Name parameter within the /promoters/edit endpoint fails to properly sanitize input, allowing for the injection of JavaScript code . This malicious script can exe...
CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...
CVE-2026-92548
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...
CVE-2026-92548
The WP Popular Posts plugin for WordPress (versions up to and including 7.4.2 ) is vulnerable to Sensitive Information Exposure . Unauthenticated attackers can extract sensitive edit-context fields—such as raw title, raw content body, password, meta, status, and guid—from non-public post objects ...
EUVD-2026-90477
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...
PT-2026-103672
Name of the Vulnerable Software and Affected Versions WP Popular Posts versions prior to 7.4.3 Description An issue exists where unauthenticated attackers can extract sensitive information from non-public post objects, such as wp block synced patterns, which are typically protected by WordPress...
CVE-2026-7175: Improper Neutralization of Input During Web Page Generation
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7173: Improper Neutralization of Input During Web Page Generation
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events/ /editgeneral during...
CVE-2026-7176: Improper Neutralization of Input During Web Page Generation
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/ - /customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the even...
PT-2026-104038
Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...