485270 matches found
CVE-2026-19471
Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page...
CVE-2026-18765
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01...
EUVD-2026-69061
Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page...
CVE-2026-19471
Rockwell Automation ArmorStart® LT is affected by multiple stored cross-site scripting (XSS) vulnerabilities. The root cause is improper sanitization of user input that is stored on the server, enabling an attacker to inject malicious scripts that execute when other users access the affected page...
CVE-2026-18765
Teracity Software Technologies E-OSB is vulnerable to SQL injection due to improper neutralization of special elements used in an SQL command. The flaw is exploitable over the network with no authentication or user interaction required, yielding a CVSS 3.1 score of 9.8 (CRITICAL) with high impact...
CVE-2026-18765 SQL Injection in Teracity Sotware's Teracity E-OSB Platform
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01...
EUVD-2026-69058
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01...
CVE-2026-7877 WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode
The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-84194
LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...
CVE-2026-84192
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...
CVE-2026-84190
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shellexec without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable...
CVE-2026-80616
A flaw was found in the Linux kernel's ieee802154 component. An unnecessary warning message WARNON can be triggered when memory allocation fails in the cfg802154switchnetns function. This can lead to diagnostic messages being logged due to deliberate fault injections, but does not pose a direct...
EUVD-2026-69063
A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function validatesqlsafety of the file openchatbi/text2sql/generatesql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 throu...
CVE-2026-84061
zhongyu09 OpenChatBI (versions up to v0.3.0) contains a remote SQL injection vulnerability in the _validate_sql_safety function within openchatbi/text2sql/generate_sql.py. Versions v0.2.0 through v0.2.2 lack SQL safety validation entirely; v0.3.0 introduced a validator, and v1.0.0b1/main retains ...
CVE-2026-84061 zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection
A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function validatesqlsafety of the file openchatbi/text2sql/generatesql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 throu...
CVE-2026-84193
LibreNMS through version 26.2.0 is affected by a stored cross-site scripting (XSS) vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields , including BGP peer descriptions, VRF names, process information, and SLA tags. An attacker with device management access o...
EUVD-2026-69031
LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...
CVE-2026-84194 LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...
CVE-2026-84194
LibreNMS versions >= 23.10.0 and
CVE-2026-84194 LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...