CVE-2026-105683

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

CVE-2026-105681

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2023-49954.github.io

SQL Injection nell'Integrazione CRM di 3CX Per l'integrazione CRM, 3CX fornisce dei template per connettersi a vari database. In questi template, i placeholder FirstName,SearchText,Email vengono utilizzati per popolare le query. L'input dell'utente non viene sanificato e quindi abilita iniezioni...

CVE-2026-105681 Ghost: Authorization Bypass in Comments Feature

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2026-105681

The Ghost Node.js content management system is affected by an authorization bypass vulnerability in its comments feature. An input validation issue allows authenticated members to access comments for which they lack proper authorization. This vulnerability affects versions 5.9.0 through 6.44.1 . ...

CVE-2026-105681 Ghost: Authorization Bypass in Comments Feature

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2026-105681 Ghost: Authorization Bypass in Comments Feature

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2022-4140

CVE-2022-4140 - WordPress plugin Welcart e-Commerce 2.8.5 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2022-4140. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own ...

CVE-2026-97275

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-58834

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — SSRF / lettura locale di file tramite URL di risposta CVE-2026-13233 Upstream non affidabile: il provider che ha recuperato l'URL indicato dalla propria risposta. Drupal OpenAI Provider aiprovideropenai · SSRF CWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053 Stato:...

CVE-2022-34962

OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS Vulnerability Explanation: È stato scoperto che OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS contiene una vulnerabilità di cross-site scripting XSS memorizzato tramite il modulo Group Timeline. Attack Vectors: L'attaccante deve...

CVE-2020-14882

Grazie a NS-Sp4ce、Jas502n、s1kr10s、demon、斯文 riferimenti： https://github.com/NS-Sp4ce/CVE-2020-14882 https://github.com/jas502n/CVE-2020-14882 https://github.com/s1kr10s/CVE-2020-14882 usage: CVE-2020-14882.py -h -u URL -f FILE -c CMD argomenti opzionali: -h, --help mostra questo messaggio di aiuto...

EUVD-2026-92612

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58834

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58834

A vulnerability exists in the setPermissionGrantState method of DevicePolicyManagerService.java , where improper input validation can lead to a persistent local denial of service . This issue does not require additional execution privileges or user interaction for exploitation. No specific remedi...

CVE-2026-58834

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-93317

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

CVE-2026-42700

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130...

CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....