13136 matches found
CVE-2025-46204
Descripción Unifiedtransform v2.0 es vulnerable a un Control de Acceso Incorrecto. Cualquier usuario estudiantes y profesores puede acceder y modificar los detalles de los cursos a través de los endpoints /course/edit/id. Esta funcionalidad está destinada exclusivamente para uso administrativo...
CVE-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...
CVE-2026-7176
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7175
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
EUVD-2026-90746
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7176
The Entradium platform by Crocantickets is vulnerable to a JavaScript injection flaw. Specifically, the Help text and Title parameters in the /events/-/custom_form/edit endpoint lack proper sanitization during the creation or modification of ticket sale forms. This allows an attacker to inject ma...
EUVD-2026-90745
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7175
The Entradium platform by Crocantickets is vulnerable to a script injection flaw in the My Profile section. Specifically, the Business Name parameter within the /promoters/edit endpoint fails to properly sanitize input, allowing for the injection of JavaScript code . This malicious script can exe...
CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...
CVE-2026-92548
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...
CVE-2026-92548
The WP Popular Posts plugin for WordPress (versions up to and including 7.4.2 ) is vulnerable to Sensitive Information Exposure . Unauthenticated attackers can extract sensitive edit-context fields—such as raw title, raw content body, password, meta, status, and guid—from non-public post objects ...
EUVD-2026-90477
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...
PT-2026-103672
Name of the Vulnerable Software and Affected Versions WP Popular Posts versions prior to 7.4.3 Description An issue exists where unauthenticated attackers can extract sensitive information from non-public post objects, such as wp block synced patterns, which are typically protected by WordPress...
CVE-2026-7175: Improper Neutralization of Input During Web Page Generation
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7173: Improper Neutralization of Input During Web Page Generation
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events/ /editgeneral during...
CVE-2026-7176: Improper Neutralization of Input During Web Page Generation
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/ - /customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the even...
PT-2026-104038
Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...