332868 matches found
CVE-2026-78080 Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors...
EUVD-2026-70452
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors...
CVE-2026-78080
CVE-2026-78080 affects the JooDatabase Lite Joomla extension (feenders.de), versions below 5.1.0 . The root cause is the cid parameter being used in database queries without input validation, enabling an unauthenticated SQL injection attack over the network with low complexity and no user interac...
CVE-2026-78080 Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors...
libpo32 v0.3.0
libpo32 A small C99 library for Teenage Engineering PO-32 acoustic data transfers and drum synthesis. libpo32 reimplements the PO-32 Tonic transfer stack and a compatible drum voice model. It is not a full PO-32 firmware or UI emulator; it covers the packet format, acoustic modem, frame decoder,...
s3dns v0.2.28
S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...
CVE-2026-85163 AVideo Server-Side Request Forgery via epg_link parameter
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and...
CVE-2026-85163
AVideo through commit c91b5975d is affected by a Server-Side Request Forgery (SSRF) vulnerability in its EPG parser . An authenticated uploader can supply an internal URL via the epg_link parameter during video upload; the value is validated only for syntax and later fetched server-side during EP...
EUVD-2026-70398
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and...
CVE-2026-85163 AVideo Server-Side Request Forgery via epg_link parameter
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and...
CVE-2026-85160
AVideo (through commit c91b5975d) is affected by a combined CSRF and path traversal vulnerability in stopLive.php . The root cause is missing token validation and unsanitized key parameter concatenation, allowing an attacker to craft a malicious image tag with a traversal payload (e.g., key=../.....
EUVD-2026-70395
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...
CVE-2026-85160 AVideo through c91b5975d CSRF and Path Traversal via stopLive.php
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...
CVE-2026-85160 AVideo through c91b5975d CSRF and Path Traversal via stopLive.php
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...
EUVD-2026-70394
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...
CVE-2026-85159 AVideo Reflected XSS via cancelUri in userLogin.php
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...
CVE-2026-85158
AVideo through commit c91b5975d is affected by a reflected cross-site scripting (XSS) vulnerability in videoEmbeded.php . The root cause is that the link parameter is echoed inside an HTML comment with zero escaping , allowing an attacker to close the comment with --> and inject arbitrary Java...
CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...
CVE-2026-85159
AVideo (through commit c91b5975d) contains a reflected cross-site scripting vulnerability in userLogin.php . The root cause lies in the isSafeRedirectURL function, which validates only the URL protocol but does not sanitize HTML characters in the cancelUri parameter. Because this parameter is ech...
CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...