24402 matches found
CVE-2026-25389
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through = 4.2.8.3...
GHSA-8QM3-746X-R74R
creationtimestamp| type| source ---|---|--- 2026-02-20 11:40:40+00:00| seen| https://gist.github.com/alon710/913d04fda246fea5d28eaa02383d9238...
CVE-2026-2691
A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manageregister.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been...
CVE-2019-25353
creationtimestamp| type| source ---|---|--- 2026-02-20 03:00:19+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfb4jjlgje2l...
CVE-2025-70873
creationtimestamp| type| source ---|---|--- 2026-02-20 02:57:12+00:00| seen| https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054 2026-06-16 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1923 2026-06-17 05:31:59+00:00| seen|...
CVE-2026-2690
A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username causes sql injection. It is possible to initiate the atta...
CVE-2026-2689
A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/managebooking.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used...
PT-2026-21165
Name of the Vulnerable Software and Affected Versions wpdiscover Timeline Event History versions through 3.2 Description The Timeline Event History component of wpdiscover is susceptible to a Reflected Cross-site Scripting issue. This occurs due to improper neutralization of input during web page...
Svelte 跨站脚本漏洞
Svelte is an open-source approach to building web applications developed by Svelte. Versions of Svelte prior to 5.51.5 contained a cross-site scripting vulnerability. This vulnerability occurred when extended syntax was used during server-side rendering, and event handler properties were included...
WordPress plugin Timeline Event History 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...
CVE-2026-25940
A flaw was found in jsPDF. The properties and methods of the Acroform module accept user input without sanitization, allowing an attacker to inject arbitrary PDF objects, such as JavaScript actions. Specifically, if an attacker can supply a specially crafted input to the...
CVE-2025-70062
creationtimestamp| type| source ---|---|--- 2026-02-19 21:03:00+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mfaikly3r22h...
CVE-2025-12845
creationtimestamp| type| source ---|---|--- 2026-02-19 20:21:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfaga6shfi2s...
CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of...
CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of...
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting XSS during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external...
Cross-site Scripting (XSS)
Overview org.webjars.npm:svelte is a package for building web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the spread syntax when rendering attributes from untrusted data during server-side rendering. An attacker can execute arbitrary JavaScript i...
CVE-2026-25389 WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through = 4.2.8.3...
CVE-2026-1655
The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4.2.8.4. This is due to the savefrontendeventsubmission function accepting a user-controlled eventid parameter and updating the correspondi...
CVE-2026-2689
A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/managebooking.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used...