CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...

CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...

CVE-2026-82914

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-82221

Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-81763

Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...

CVE-2026-81764

Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...

CVE-2026-81291

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

CVE-2026-81756

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81293

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-79408

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...

CVE-2026-81287

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2025-22964

CVE-2025-22964: DDSN Interactive cm3 Acora CMS 버전 10.1.1의 시간 기반 블라인드 SQL 인젝션 DDSN Interactive cm3 Acora CMS 버전 10.1.1에는 "table" 매개변수에 대한 입력 정제 및 검증 부족으로 인해 발생하는 시간 기반 블라인드 SQL 인젝션 취약점이 존재합니다. 이 결함으로 인해 공격자는 적절한 이스케이프 또는 검증 없이 사용자 제공 입력을 데이터베이스 쿼리에 직접 포함시켜 악성 SQL 쿼리를 주입할 수 있습니다. 이 문제를 악용하면 무단 액세스,...

CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBX

Сканер уязвимостей FreePBX CVE-2025 ⚠️ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ ТОЛЬКО ДЛЯ ОБРАЗОВАТЕЛЬНЫХ И АВТОРИЗОВАННЫХ ТЕСТОВ Этот инструмент предоставляется «КАК ЕСТЬ» только для образовательных и исследовательских целей Авторы НЕ несут ответственности за любое неправомерное использование или незаконные...

Command Injection

Overview @snyk/sweater-comb is a “Sweats the small stuff, so you don’t have to. OpenAPI linting rules for Snyk APIs.” Affected versions of this package are vulnerable to Command Injection through the expectGitBranch function in src/lint.ts. An attacker can execute arbitrary OS commands by supplyi...

CVE-2025-60876

CVE-2025-60876: busybox wget 요청 대상 삽입 수정 CVE-2025-60876에 대한 동작을 유지하는 수정 사항입니다. 이는 BusyBox wget의 HTTP 헤더 삽입 취약점이며, 이를 증명하는 개념 증명PoC과 수정 사항을 BusyBox 업스트림에 제출하기 위한 아티팩트가 포함되어 있습니다. 취약점 BusyBox wget은 URL 경로와 쿼리를 HTTP 요청 라인에 그대로 복사합니다. 원시 CR0x0D, LF0x0A 또는 기타 제어 바이트를 포함하는 URL은 요청 라인을 분할하고 공격자가 제어하는 헤더...

CVE-2026-82914

kishan0725 Hospital-Management-System 1.0 contains a SQL injection vulnerability in the file /search.php , triggered by manipulation of the Contact argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL queries, resulting in low impact on confidentiality, integrity,...

EUVD-2026-68807

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-82226

This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...