60815 matches found
EUVD-2026-19496
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The...
CVE-2026-35395
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA Web gerenciador para instituições assistenciais contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The idmemorando parameter is extracted from $REQUEST without validation and directly interpolated into...
CVE-2026-35395
CVE-2026-35395 affects WeGIA, a web manager for charitable institutions. Before version 3.6.9, the vulnerability exists in dao/memorando/DespachoDAO.php where the parameter id_memorando is read from $_REQUEST without validation and directly interpolated into SQL queries. This leads to a SQL injec...
CVE-2026-35395 WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA Web gerenciador para instituições assistenciais contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The idmemorando parameter is extracted from $REQUEST without validation and directly interpolated into...
EUVD-2026-19495
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA Web gerenciador para instituições assistenciais contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The idmemorando parameter is extracted from $REQUEST without validation and directly interpolated into...
GHSA-9CQF-439C-J96R
creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:44+00:00| seen| Telegram/RmP7l-K41x9UoCBscD5W8eizA4yDJaPJqAKKOeWwXNyu-8...
GHSA-JG96-P5P6-Q3CV
creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:44+00:00| seen| Telegram/RmP7l-K41x9UoCBscD5W8eizA4yDJaPJqAKKOeWwXNyu-8...
GHSA-RP9M-7R4C-75QG
creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:09+00:00| seen| Telegram/t1F-Vxaulmn07lvg5ppSTSOssGvqtwkUpkkBVUVRjFPlk...
GHSA-QCMW-8MM4-4P28
creationtimestamp| type| source ---|---|--- 2026-04-06 19:28:45+00:00| published-proof-of-concept| Telegram/ECjdy8s76GZBalwnIB79ij56tbajMeprVumTyCn-zmzM...
GHSA-P5RH-VMHP-GVCW
creationtimestamp| type| source ---|---|--- 2026-04-06 19:28:28+00:00| published-proof-of-concept| Telegram/nNz4AuVWmZsX2vjW9IzWDm0wIi6EKHH8QFJ1lll9JUSWJdI 2026-04-07 02:48:17+00:00| seen| https://bsky.app/profile/cyber-news-fi.bsky.social/post/3miurceg26g22...
CVE-2026-5681 itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection
A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument empid causes sql injection. The attack is possible to be carried out remotely. The explo...
CVE-2026-5681 itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection
A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument empid causes sql injection. The attack is possible to be carried out remotely. The explo...
CVE-2026-35458
creationtimestamp| type| source ---|---|--- 2026-04-06 19:06:54+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992 2026-04-07 17:29:08+00:00| seen| Telegram/S0o7tCbZtDmnRvZjM5kXvvB9yXwoblxnXV5GlrmaLffoEZI...
CVE-2026-35179 WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access...
CVE-2026-5659
A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.setstate of the file src/datrie.pyx of the component trie File Handler. The manipulation results in deserialization. The attack can be launched remotely. The exploit has been mad...
CVE-2025-48651
In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-5672
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument catid leads to sql injection. It is possible to initiate the...
GHSA-36XV-JGW5-4Q75 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Impact What kind of vulnerability is it? Who is impacted? SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and \n as field delimiters and \n\n as...
CVE-2026-5672 code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument catid leads to sql injection. It is possible to initiate the...