483567 matches found
CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...
CVE-2026-82914
A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...
CVE-2026-82221
Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82226
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
CVE-2026-81763
Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...
CVE-2026-81764
Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...
CVE-2026-81291
Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...
CVE-2026-81756
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...
CVE-2026-81293
Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...
CVE-2026-79483
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...
CVE-2026-81287
Subscriber SQL Injection in Charitable = 1.8.12.1 versions...
CVE-2026-79408
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...
Command Injection
Overview @snyk/sweater-comb is a “Sweats the small stuff, so you don’t have to. OpenAPI linting rules for Snyk APIs.” Affected versions of this package are vulnerable to Command Injection through the expectGitBranch function in src/lint.ts. An attacker can execute arbitrary OS commands by supplyi...
CVE-2026-82914
kishan0725 Hospital-Management-System 1.0 contains a SQL injection vulnerability in the file /search.php , triggered by manipulation of the Contact argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL queries, resulting in low impact on confidentiality, integrity,...
EUVD-2026-68807
A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...
CVE-2026-82226
This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...
CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
EUVD-2026-68796
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...