PT-2026-68535

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.11 Description The Simply Schedule Appointments plugin for WordPress contains a flaw allowing unauthenticated attackers to perform SQL Injection. This occurs due to insufficient escaping of...

CVE-2026-13161: Improper Neutralization of Special Elements used in an SQL Command

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...

FreeBSD : Erlang/OTP -- relative path traversal in the zip module (445e11d4-89e1-11f1-b35c-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445e11d4-89e1-11f1-b35c-4c526214c986 advisory. The Erlang/OTP team reports: Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a...

Linux Distros Unpatched Vulnerability : CVE-2026-47078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive...

CVE-2026-65921

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

CVE-2026-65921 Potential path traversal leading to unauthorized file writes

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

CVE-2026-65921

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

EUVD-2026-49569

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

CVE-2026-65921

Technical details, including affected product/version, root cause, and remediation, are not publicly available in the provided documents; monitor for updates.

CVE-2026-65921 Potential path traversal leading to unauthorized file writes

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

DEBIAN-CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

UBUNTU-CVE-2026-51298

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview unzipper is a library for the Uzip cross-platform streaming AP.I Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the extraction path validation in lib/extract.js and lib/Open/directory.js, which check only that the resolved path...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.webjars.npm:unzipper is a library for the Uzip cross-platform streaming AP.I Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the extraction path validation in lib/extract.js and lib/Open/directory.js, which check only that t...

CVE-2026-66398

CVE-2026-66398 affects phpMyFAQ releases before 4.1.6. Affected component: configuration API. Root cause: an authenticated administrator with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges can abuse upgrade.lastDownloadedPackage to write arbitrary PHP files. Attack flow: upload a malicious ZIP ...

CVE-2026-10600

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server v...

CVE-2026-47078

The CVE affects Erlang/OTP stdlib’s zip handling (lib/stdlib/src/zip.erl). zip:unzip/1,2 and zip:extract/1,2 validate entry paths with zip:check_dir_level/2, which tracks directory depth; while .. can decrement the counter and normal components increment it, a path like ../x/y may become negative...

CVE-2026-47078 Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

EUVD-2026-49317

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...