112560 matches found
CVE-2022-3992
CVE-2022-3992 ثغرة برمجة نصية عبر المواقع XSS في WonderCMS الوصف: تسمح ثغرة أمنية من نوع البرمجة النصية عبر المواقع XSS في نظام إدارة التعقيم الإصدار 1.0 للمهاجمين المحتملين برفع ملفات عشوائية عبر اسم معدل في حقول شعار النظام ضمن حقول معلومات النظام. لا يحتوي ملف تعريف الارتباط على علامة HttpOnly...
CVE-2024-7135
CVE-2024-7135 إن إضافة Tainacan لـ WordPress معرضة للوصول غير المصرح به إلى البيانات بسبب عدم وجود فحص للصلاحية في الدالة 'getfile' في جميع الإصدارات حتى 0.21.7 وما يشملها. كما أن الدالة معرضة أيضًا لثغرة اجتياز الدليل directory traversal. وهذا يتيح للمهاجمين المصادق عليهم، من مستوى Subscriber فم...
CVE-2026-97303
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2...
CVE-2026-97304
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...
CVE-2026-97309
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...
CVE-2026-58865
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-103086
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...
CVE-2026-102383
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...
CVE-2026-20253
CVE-2026-20253 — Splunk Enterprise प्री-ऑथ RCE लैब अप्रमाणित मनमाना फ़ाइल निर्माण और कटाव PostgreSQL साइडकार के माध्यम से CVSS 9.8 · क्रिटिकल · CWE-306 · सक्रिय रूप से शोषित CISA KEV ⚠️ अस्वीकरण यह रिपॉजिटरी केवल शैक्षिक और अधिकृत सुरक्षा अनुसंधान उद्देश्यों के लिए है। सभी परीक्षण आपके स्वामित्व...
CVE-2026-58865
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-92618
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58865
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58865
A vulnerability exists in multiple functions of PduParser.java due to a missing bounds check . This flaw can lead to a persistent denial of service (DoS) or a remote denial of service without requiring additional execution privileges or user interaction. No specific exploitation details are provi...
CVE-2026-45524
In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-66391
इस रिपॉजिटरी में README नहीं है।...
CVE-2026-105638
The project management tool Plane is vulnerable to a 6-digit OTP brute force attack in versions prior to 1.4.0 . The magic-code email login verifier lacks a per-code failed-attempt counter, fails to invalidate Redis entries on incorrect attempts, and does not lock email addresses. Because the ver...
EUVD-2026-92594
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...
CVE-2026-105638 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...