36 matches found
WELA
WELA Windows Event Log Analyzer ゑ羅 A tool for auditing Windows event log settings. Created by Yamato Security — make sure you are actually recording the events that matter for DFIR. 📖 Read the Documentation → Available in 15 languages — English · 日本語 · 繁體中文 · 한국어 · Deutsch · Türkçe · Français ·...
EUVD-2026-87526
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...
CVE-2026-15273
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in version 4.0.0 . The root cause is insufficient input sanitization and output escaping related to the REQUEST_URI . This flaw allows unauthenticated attackers to inject arbitrary web scripts, which execute...
PT-2026-99236
Name of the Vulnerable Software and Affected Versions Automatic.css version 4.0.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via the REQUEST URI variable. This allows the injection of arbitrary web...
CVE-2026-15273: Improper Neutralization of Input During Web Page Generation
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...
Zyxel P660HN-T v2 RCE
Remote command execution in Zyxel P660HN-T V2 devices via blind command injection in log settings commands up to 28 characters. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel P660HN-T v2 RCE""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...
PT-2026-56149
Name of the Vulnerable Software and Affected Versions WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell versions prior to 3.12.8 Description Unauthenticated attackers can achieve Remote Code Execution by sending unsanitized values through the postData parameter. The plug...
Schneider Electric PowerChute Serial Shutdown Security Bypass Vulnerability (CNVD-2026-18328)
Schneider Electric PowerChute Serial Shutdown is a UPS management, normal shutdown and energy management software from Schneider Electric France. A security bypass vulnerability exists in Schneider Electric PowerChute Serial Shutdown that stems from improper validation of a specified number of...
CVE-2026-2403
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload...
CVE-2026-2403
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload...
Schneider Electric PowerChute Serial Shutdown security vulnerability
Schneider Electric PowerChute Serial Shutdown is a UPS management, normal shutdown and energy management software from Schneider Electric France. A security bypass vulnerability exists in Schneider Electric PowerChute Serial Shutdown that stems from improper validation of a specified number of...
PT-2026-32675
Name of the Vulnerable Software and Affected Versions PowerChute Serial Shutdown affected versions not specified Description Improper validation of specified quantity in input occurs when a Web Admin user alters the payload of the 'POST /logsettings' request. This issue can lead to Event and Data...
CVE-2025-67859
A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...
CVE-2025-67859
A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...
CVE-2025-67859
A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...
CVE-2025-67859
A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...
CVE-2025-67859 Polkit Authorization Check can be Bypassed in the TLP power daemon
A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...
CVE-2025-67859
The CVE-2025-67859 entry relates to an improper authentication vulnerability in the TLP power daemon (Polkit-related) that allows a local user to arbitrarily change the active power profile and the daemon’s log settings. Affected software is TLP (versions 1.9 before 1.9.1). The issue is categoriz...
CVE-2025-67859: Improper Authentication
A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...