12260 matches found
CVE-2026-100257
In JetBrains YouTrack versions prior to 2026.2.18991 , a vulnerability exists where Server-Side Request Forgery (SSRF) can occur via stored XHTML injection during the PDF export process. The provided documents do not specify the exact root cause or specific remediation steps beyond the affected v...
CVE-2026-100257
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export...
CVE-2026-94178
Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...
CVE-2026-94178 WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...
CVE-2026-94178 WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...
CVE-2026-94178
The WordPress Import and export users and customers plugin, versions
CVE-2026-96886
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...
CVE-2026-96886 Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...
CVE-2026-96886
The Course Booking System WordPress plugin, in versions prior to 7.0.9 , contains a vulnerability where it fails to restrict access to its booking export function. This allows unauthenticated users to download sensitive personally identifiable information (PII), including the name, email address,...
EUVD-2026-89626
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...
EUVD-2026-89468
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request...
CVE-2026-102099: Improper Limitation of a Pathname to a Restricted Directory
Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially...
CVE-2026-96886: Exposure of Sensitive Information to an Unauthorized Actor
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...
Telerik UI for ASP.NET AJAX 2008.3.1314 < 2026.2.708 RadEditor PDF Export SSRF
The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2008.3.1314 or later and prior to 2026.2.708. It is, therefore, affected by a server-side request forgery vulnerability. Insufficient validation of content submitted to the RadEditor PDF export feature may...
CVE-2026-100257: Server-Side Request Forgery (SSRF)
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export...
CVE-2026-94178: Incorrect Privilege Assignment
Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...
PT-2026-103304
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored XHTML injection allows for Server-Side Request Forgery SSRF, a technique where an attacker induces the server to make requests to an unintended location, during the PDF expor...
PT-2026-103537
Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An improper restriction of a user-supplied file path in an administrative export feature allows an authenticated administrator to write a file to an arbitrary location on the underlying host...
PT-2026-102968
Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus...