CVE-2024-41453_CVE-2024-41454

CVE-2024-41453 CVE-2024-41454 ProcessMaker Vulnerabilites just for education: @ryancooley @velkymx @nolanpro @caleeli install ProcessMaker 4 Core Docker Instance frome this repository: https://github.com/ProcessMaker/pm4core-docker this is latest pm docker version PMVERSION=4.1.21, below image is...

CVE-2026-112066

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

EUVD-2026-104873

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-112066

The sgalinski Cookie Consent (sg_cookie_optin) extension is vulnerable to a Missing Authorization flaw during the JSON import of cookie consent configurations. Specifically, the import process fails to validate the backend user's permissions, allowing non-admin backend users with module access to...

CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

PT-2026-118303

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-63630

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf sends an...

CVE-2026-19634

A flaw was found in PostgreSQL Anonymizer. A SQL injection vulnerability exists in the importdatabaserules and importrolesrules functions. A malicious user can craft a JSON document with specially designed object names. If a superuser then imports this document, the malicious code within it can b...

CVE-2026-19634 PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

WordPress Visualizer: Tables and Charts Manager plugin < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import vulnerability

Contributor+ Server-Side Request Forgery via JSON Import vulnerability discovered by creeperkirby in WordPress Plugin Visualizer versions 4.0.6...

CVE-2026-14939 Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

CVE-2026-14939 Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

Directory Traversal

Overview awxkit is a The official command line interface for Ansible AWX Affected versions of this package are vulnerable to Directory Traversal via the !include directive in YAML files. An attacker can access arbitrary YAML-formatted files from the local filesystem by tricking a user into...

dinky (1.0.0), jasql (0.5.0-beta.0) +2 more potentially affected by unknown CVE via mongo-parse (1.1.0)

mongo-parse NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mongo-parse and may be impacted: - dinky 1.0.0 - jasql 0.5.0-beta.0 - nqm-common-import =0.0.0, =0.0.0, =0.0.24 Source cves: unknown CVE Source advisory: MEND:WS-2017-0241...

WordPress plugin “Get Use APIs” has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There wa...

CVE-2026-1487

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers...

CVE-2026-1487

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers...

CVE-2026-1487

CVE-2026-1487 relates to the LatePoint WordPress plugin (Calendar Booking Plugin for Appointments and Events), with vulnerability in all versions up to and including 5.2.7. The issue is an authenticated SQL injection via JSON Import, exploitable by attackers with Administrator-level access and ab...

CVE-2026-1487 LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers...

CVE-2026-1487

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers...