CVE-2026-109323

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only voteaccess and readonly enforcement. Attackers can use the anonymous nonce emitted by getData to submit votes directly to addVote, manipulatin...

CVE-2026-109323 Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only voteaccess and readonly enforcement. Attackers can use the anonymous nonce emitted by getData to submit votes directly to addVote, manipulatin...

EUVD-2026-97625

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only voteaccess and readonly enforcement. Attackers can use the anonymous nonce emitted by getData to submit votes directly to addVote, manipulatin...

CVE-2026-109323

The Grav Star Ratings plugin (versions 2.0.1 through 2.0.3 ) contains a missing server-side authorization vulnerability (CWE-862). This flaw allows unauthenticated visitors to bypass client-side vote_access and readonly enforcement. By utilizing an anonymous nonce obtained from the getData() func...

CVE-2026-101010

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-101010 aaPanel BaoTa data.py getData sql injection

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-101010 aaPanel BaoTa data.py getData sql injection

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-101010

A SQL injection vulnerability exists in aaPanel BaoTa versions up to 11.8.0 . The flaw is located in the getData function within the file /www/server/panel/class/data.py, where improper handling of the log_type argument allows for exploitation. Attackers can initiate this attack remotely . While ...

EUVD-2026-88123

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-101010: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

PT-2026-99785

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A remote SQL injection is possible through the manipulation of the log type argument within the getData function located in the /www/server/panel/class/data.py file. SQL injection is a techniq...

Linux Distros Unpatched Vulnerability : CVE-2026-77301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory...

CVE-2026-77301

A flaw was found in adm-zip, a JavaScript library for handling ZIP archives. The getData function in zipEntry.js allocates memory based on the declared uncompressed size in a ZIP entry's central directory without validating this value against the actual compressed data. A remote attacker can...

SUSE CVE-2026-77301

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301

adm-zip is a Node.js JavaScript library for creating and extracting ZIP archives. Prior to version 0.6.1 , the getData() function in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and de...

CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301: Memory Allocation with Excessive Size Value

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

PT-2026-95496

Name of the Vulnerable Software and Affected Versions adm-zip versions prior to 0.6.1 Description The getData function in zipEntry.js trusts the uncompressed size declared in a ZIP entry's central directory and allocates output memory using Buffer.alloc before validating this value against the...