14992 matches found
CVE-2026-34051
OpenEMR versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import/export actions via direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipula...
CVE-2026-34051 OpenEMR has Improper ACL On Import/Export Popup
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulati...
CVE-2026-34051 OpenEMR has Improper ACL On Import/Export Popup
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulati...
EUVD-2026-16044
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulati...
CVE-2026-34051 OpenEMR has Improper ACL On Import/Export Popup
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulati...
CVE-2026-33913 OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing to read arbitrary files from the server. Version 8.0.0....
CVE-2026-33913
OpenEMR is affected by a CCDA import vulnerability (XInclude Injection) in the Carecoordination module prior to v8.0.0.3. An authenticated user can upload a crafted CCDA containing to read arbitrary server files. The issue is mitigated by upgrading to OpenEMR v8.0.0.3. The CVSS details indicate ...
GHSA-7PQ3-326H-F8Q9 Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
Authenticated Path Traversal to RCE via Configuration Import Summary An authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Details The...
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
Authenticated Path Traversal to RCE via Configuration Import Summary An authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Details The...
EUVD-2026-15821
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through = 2.4.9...
CVE-2026-32441
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through = 2.4.9...
CVE-2026-32441 WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through = 2.4.9...
CVE-2026-32441
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through = 2.4.9...
CVE-2026-32441 WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through = 2.4.9...
CVE-2026-32441
CVE-2026-32441 is a Missing Authorization vulnerability in the WordPress plugin Comments Import & Export for WooCommerce, affecting versions up to and including 2.4.9. Connected sources confirm the issue type but do not provide exploit vectors, exact root cause, or a published fix in the supplied...
Path Traversal
SiYuan is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths in the importZipMd function, which allows an authenticated attacker to overwrite arbitrary files on the system and potentially achieve remote code execution...
Malicious code in auth0-ai-ms-agent (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2e341dbac5b5fcd3b5a882b5ee47e26051b72bacd4d552790c684174ba0e69ae Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
SUSE CVE-2026-30247
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, the application's "Import document via URL" feature is vulnerable to Server-Side Request Forgery SSRF through HTTP redirects. While the backend implements comprehensive UR...
SUSE CVE-2026-30832
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is...
CVE-2026-32441: Missing Authorization
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through = 2.4.9...