EUVD-2025-210531

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

CVE-2025-65337: Improper Neutralization of Input During Web Page Generation

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

PT-2026-65780

Name of the Vulnerable Software and Affected Versions Aimy Captcha-Less Form Guard versions 18.0 through 20.0 Description PHP object injection occurs when a forged clfgd field is processed, which can lead to remote code execution. PHP object injection is a vulnerability where untrusted input is...

CVE-2025-65337

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) . The flaw exists in the pageEditMember.php component, specifically triggered through the address field. Exploitation details or specific proof-of-concept links are not provided in the documentation. Impact is chara...

CVE-2026-13425: Improper Neutralization of Input During Web Page Generation

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-65679

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi form field' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-65337

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

CVE-2026-16655: Improper Neutralization of Input During Web Page Generation

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

CVE-2025-65337

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

EUVD-2026-50077

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled defaultfactory values in...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the selecteval custom field type. An attacker can execute arbitrary Ruby code on the server by supplying a malicious expression in the field options command parameter, which is evaluated through instanceeval...

CVE-2026-6881

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...

CVE-2026-6881 Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...

CVE-2026-6881

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...

CVE-2026-6881

Summary: CVE-2026-6881 describes an SQL injection in Ellucian Advance Web and Legacy Advance (Giving Reports) that allows an authenticated attacker to exfiltrate data by crafting SQL in the class credit field. Affected products: Ellucian Advance Web and Legacy Advance (all versions). Ellucian CRM...

EUVD-2026-50019

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...

CVE-2026-66748

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...

MariaDB: Connector/C Out-of-bounds read in `unpack_fields()` from short metadata field

A buffer over-read vulnerability was identified in the metadata field parsing function within the database connector library. The function processed fixed-header metadata without validating that the field data contained the required minimum length of 12 bytes. A malicious or compromised server...

CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...