20962 matches found
CVE-2026-2247 SQL Injection in Clickedu's SaaS platform
SQL injection vulnerability SQLi in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker executes a malicious payload in the URL generated after downloading the student's report card in the ‘Day-to-day’ section from the mobile...
Clicldeu SaaS SQL注入漏洞
Clicldeu SaaS is a cloud-based education management platform developed by the Spanish company Clicldeu. Clicldeu SaaS has a SQL injection vulnerability. This vulnerability arises from the fact that session tokens are not expired during the report generation process, and insufficient validation is...
CVE-2026-2247: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability SQLi in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker executes a malicious payload in the URL generated after downloading the student's report card in the ‘Day-to-day’ section from the mobile...
CVE-2025-8303: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in EKA Software Computer Information Advertising Services Ltd. Real Estate Script V5 With Doping Module – Store Module – New Language System allows Cross-Site Scripting XSS. This issue affects...
PT-2026-8402
SQL injection vulnerability SQLi in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker executes a malicious payload in the URL generated after downloading the student's report card in the ‘Day-to-day’ section from the mobile...
PT-2026-20270
Name of the Vulnerable Software and Affected Versions EKA Software Real Estate Script versions through 17022026 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, also known as Cross-Site Scripting XSS. This allows for the execution of maliciou...
EKA Real Estate Script 跨站脚本漏洞
EKA Real Estate Script is a real estate portal system developed by the Turkish company EKA. The EKA Real Estate Script V5 version, as well as earlier versions, contained a cross-site scripting vulnerability. This vulnerability stemmed from improper input during web page generation, which could le...
KOREX
⚡ KOREX FRAMEWORK ⚡ Advanced Security Operations Framework "Kore...
CVE-2026-2439 Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids
Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generatesessionid function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are...
EUVD-2026-6091
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...
CVE-2026-2555
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...
CVE-2026-2555
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...
CVE-2026-2555 JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...
CVE-2025-59904: Improper Neutralization of Input During Web Page Generation
Stored Cross-Site Scripting XSS vulnerability in Kubysoft, which is triggered through multiple parameters in the '/kForms/app' endpoint. This issue allows malicious scripts to be injected and executed persistently in the context of users accessing the affected resource...
kernel security update
5.14.0-611.34.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...
Concierge::Sessions 安全漏洞
Concierge::Sessions is a user management system developed by Bruce Van Allen personally. Versions of Concierge::Sessions prior to 0.8.5 contained security vulnerabilities. These vulnerabilities stemmed from the use of the generatesessionid function, which defaults to using the uuidgen command to...
CVE-2026-2555: Deserialization of Untrusted Data
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...
yandex_station_2_exploit
Загрузчик неподписанного кода для Yandex Station 2 Yandex Max...
SUSE CVE-2026-24044
Element Server Suite Community Edition ESS Community deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Helm Chart secrets initialization hook using matrix-tools container before 0.5.7 is using an insecure Matrix server key generation method,...