7912 matches found
CVE-2026-26338: Server-Side Request Forgery (SSRF)
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery SSRF through the document processing functionality...
CVE-2026-23541: Missing Authorization
Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through = 1.19.4...
📄 Pterodactyl Panel Remote Code Execution
This Metasploit module exploits a remote code execution vulnerability in Pterodactyl Panel versions before 1.11.11. The vulnerability allows an attacker to write a malicious PHP file via the locale functionality and then execute it to gain a reverse shell...
CVE-2026-2564
The CVE-2026-2564 entry affects Intelbras VIP 3260 Z IA (2.840.00IB005.0.T). The vulnerability concerns an unknown functionality in the /OutsideCmd file, enabling weak password recovery and permitting remote exploitation. Exploitation is described across sources as remote, with high complexity an...
CVE-2019-25367 ArangoDB Community Edition 3.4.2-1 XSS via aardvark admin interface
ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface index.html through search, user management, and API parameters. Attackers can inject scripts via parameters in /db/system/admin/aardvark/index.html to execute JavaScript i...
SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality...
CVE-2025-14014: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd. Co. Smart Panel allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Smart Panel: before 20251215...
VulnCheck KEV: CVE-2025-40536
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality...
CVE-2025-64074
The Shenzhen Zhibotong Electronics ZBT WE2001 wireless router (version 23.09.27 ) is affected by a path-traversal vulnerability in its logout functionality . The root cause is incorrect restrictions on the path name to the directory within the microprogrammed software. A remote attacker can explo...
CVE-2025-64074: Improper Limitation of a Pathname to a Restricted Directory
A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to delete arbitrary files on the host by supplying a crafted session cookie value...
Siemens SCALANCE and RUGGEDCOM Incorrect Authorization (CVE-2025-40567)
The Load Rollback functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with guest role to make the affected product roll back configuration changes made by privileged users. This plugin...
EUVD-2026-5703
Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations...
CVE-2026-25859
Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations...
CVE-2026-25859 WeKan < 8.20 Migration Functionality Insufficient Permission Checks
Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations...
CVE-2026-2111
JeecgBoot
CVE-2026-25859: Incorrect Authorization
Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations...
PT-2026-6679
Name of the Vulnerable Software and Affected Versions Tune Library plugin for WordPress versions up to and including 1.6.3 Description The Tune Library plugin for WordPress is susceptible to Stored Cross-Site Scripting through the CSV import functionality. This is a result of inadequate input...
Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo_Project Sudo
CVE-...