PT-2026-21576

Name of the Vulnerable Software and Affected Versions itsourcecode Event Management System version 1.0 Description A SQL injection issue exists in itsourcecode Event Management System version 1.0. Remote attackers can exploit this by manipulating the ID argument in the /admin/index.php file. The...

CVE-2026-25556

creationtimestamp| type| source ---|---|--- 2026-02-22 12:55:58+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mfh6qh6qa22o 2026-02-23 12:16:34+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mfjmyveiys2b 2026-02-23 12:47:31+00:00| seen|...

CVE-2025-69384

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through = 3.2...

Exploit for CVE-2026-27470

CVE-2026-27470 — ZoneMinder Second-Order SQL Injection !CVE...

CVE-2026-27480

creationtimestamp| type| source ---|---|--- 2026-02-21 12:40:40+00:00| seen| https://gist.github.com/alon710/e56b547bb8d66c88c36130e6613a09b3...

GHSA-CXPW-2G23-2VGW

creationtimestamp| type| source ---|---|--- 2026-02-21 10:10:40+00:00| seen| https://gist.github.com/alon710/63b57342d7d50b3729afe629902bba13...

CVE-2026-27470 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2026-27470

ZoneMinder (versions 1.36.37 and earlier; 1.37.61–1.38.0) contains a second‑order SQL Injection in web/ajax/status.php:getNearEvents(). Although event fields Name and Cause are stored via parameterized queries, they are concatenated into SQL WHERE clauses without escaping, allowing an authenticat...

CVE-2026-27470 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2026-27470 ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2026-27197

creationtimestamp| type| source ---|---|--- 2026-02-21 05:22:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfduvvxblh2c 2026-02-21 06:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116107092205933105 2026-02-21 06:00:31+00:00| seen|...

CVE-2026-27121 Svelte affected by cross-site scripting via spread attributes in Svelte SSR

svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting XSS during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an...

CVE-2026-27121 Svelte affected by cross-site scripting via spread attributes in Svelte SSR

svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting XSS during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an...

CVE-2026-27121

Technical details for CVE-2026-27121 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-26192

creationtimestamp| type| source ---|---|--- 2026-02-20 22:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfd5die5rt2u 2026-07-07 18:35:07+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-xc8p-9rr6-97r2...

CVE-2025-69384

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through = 3.2...

CVE-2025-69384 WordPress Timeline Event History plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through = 3.2...

CVE-2025-69384

CVE-2025-69384 affects the WordPress Timeline Event History plugin (timeline-event-history) up to version 3.2. The issue is a Reflected XSS caused by improper input neutralization during web page generation, with CVSS v3.1 base score 7.1 (HIGH). The affected component is the timeline-event-histor...

CVE-2025-69384 WordPress Timeline Event History plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through = 3.2...