CVE-2025-50670

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwglbwr.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request in the name, qq, and time parameters...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006831)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006831 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error while searching for backlight device parent If acpigetparent called ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006705)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006705 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser-buffer when tracegetuser failed When the length of the string...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006720)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006720 advisory. In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure userlength is taken into account when fetching packet contents Ensure that...

CVE-2025-50671

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwglref.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with excessively long strings in parameters name, en, userid, shibiename, time,...

WordPress plugin Gravity Forms 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

CVE-2025-50666

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /webpost.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request in parameters such as name, en, userid, log, and time...

CVE-2025-50671

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwglref.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with excessively long strings in parameters name, en, userid, shibiename, time,...

CVE-2025-50665

CVE-2025-50665 describes a buffer overflow in the D-Link DI-8003 (firmware 16.07.26A1) caused by improper handling of input parameters to the /web_keyword.asp endpoint. A crafted HTTP GET request using parameters such as name, en, time, mem_gb2312, and mem_utf8 can trigger the vulnerability. The ...

CVE-2025-50664

The CVE-2025-50664 entry concerns a buffer overflow in D-Link DI-8003 (firmware 16.07.26A1) caused by improper handling of parameters in the /user_group.asp endpoint. An attacker can trigger it by sending a crafted HTTP GET with parameters name, mem, pri, and attr, potentially leading to denial o...

SourceCodester Sales and Inventory System 代码注入漏洞

The SourceCodester Sales and Inventory System is an open-source sales and inventory management system developed by SourceCodester. Version 1.0 of the SourceCodester Sales and Inventory System contains a code injection vulnerability. This vulnerability stems from the handling of parameter IDs in t...

CVE-2025-50664

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /usergroup.asp endpoint. The attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, mem, pri, and attr...

CVE-2025-50665

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of input parameters in the /webkeyword.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request via the name, en, time, memgb2312, and memutf8 parameters...

CVE-2025-50665

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of input parameters in the /webkeyword.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request via the name, en, time, memgb2312, and memutf8 parameters...

CVE-2025-50661

CVE-2025-50661 describes a buffer overflow in the D-Link DI-8003 (firmware 16.07.26A1) caused by improper handling of multiple parameters in the /url_rule.asp endpoint. A crafted HTTP GET request including parameters name, en, ips, u, time, act, rpri, and log can trigger the overflow, leading to ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006703)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006703 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: handle getclientlocked failure in nfsd4setclientidconfirm Lei Lu recently reported that...

CVE-2026-4406

The CVE concerns Gravity Forms for WordPress (≤ 2.9.30) with a Reflected XSS in the gform_get_config AJAX action via the form_ids parameter. The root cause is that GFCommon::send_json() returns JSON wrapped in HTML comments using echo/wp_die(), sending a text/html header instead of application/js...

CVE-2026-4406 Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the formids parameter in the gformgetconfig AJAX action in all versions up to, and including, 2.9.30. This is due to the GFCommon::sendjson method outputting JSON-encoded data wrapped in HTML comment...

CVE-2026-35474

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $GET with no URL validation or whitelist check, then used verbatim in a header"Location: ..." call. This vulnerability is fixed in 3.6.9...

CVE-2026-35475

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $GET with no URL validation or whitelist check, then used verbatim in a header"Location: ..." call. This vulnerability is fixed in 3.6.9...