CVE-2026-77353

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0 , authenticated users could inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. The root cause is that the input...

CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...

CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...

CVE-2026-82914

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-82221

Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-81763

Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...

CVE-2026-81764

Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...

CVE-2026-81291

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

CVE-2026-81756

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81293

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-79408

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...

CVE-2026-81287

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2025-22964

CVE-2025-22964: DDSN Interactive cm3 Acora CMS バージョン10.1.1における時間ベースのブラインドSQLインジェクション DDSN Interactive cm3 Acora CMS...

CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBX

FreePBX CVE-2025 脆弱性スキャナー ⚠️ 免責事項 教育および許可されたテスト目的のみ このツールは「現状のまま」教育および研究目的でのみ提供されます 著者は一切の誤用や違法行為に対して責任を負いません 許可のないコンピュータシステムへのアクセスは違法です 自分の所有するシステム、または明示的な書面による許可を得たシステムでのみ使用してください ユーザーは適用されるすべての法律の遵守に対して単独で責任を負います 本ツールを使用することにより、法律および倫理に従って使用することに同意したものとみなします。 📖 説明...

Command Injection

Overview @snyk/sweater-comb is a “Sweats the small stuff, so you don’t have to. OpenAPI linting rules for Snyk APIs.” Affected versions of this package are vulnerable to Command Injection through the expectGitBranch function in src/lint.ts. An attacker can execute arbitrary OS commands by supplyi...

CVE-2025-60876

CVE-2025-60876：busybox wget リクエストターゲットインジェクション修正 CVE-2025-60876（BusyBox wget における HTTP ヘッダインジェクション脆弱性）に対する動作を維持する修正、それを実証する概念実証、および修正を BusyBox にアップストリーム提出するための成果物です。 脆弱性 BusyBox wget は、URL のパスとクエリを HTTP リクエスト行にそのままコピーします。生の CR 0x0D、LF 0x0A、またはその他の制御バイトを含む URL...

CVE-2026-82914

kishan0725 Hospital-Management-System 1.0 contains a SQL injection vulnerability in the file /search.php , triggered by manipulation of the Contact argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL queries, resulting in low impact on confidentiality, integrity,...

EUVD-2026-68807

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...