53 matches found
CVE-2026-121435
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...
CVE-2026-121435 Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...
CVE-2026-121435 Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...
CVE-2026-121435
Froxlor versions before 2.3.15 are affected by an authorization bypass vulnerability in the Mysqls.add API endpoint. The root cause is a missing customer_hide_options check, which allows authenticated customers to create MySQL databases even if the administrator has globally disabled the MySQL fe...
EUVD-2026-115857
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...
CVE-2026-121435 Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...
CVE-2026-121435: froxlor: Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create…
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature,...
PT-2026-65308
Name of the Vulnerable Software and Affected Versions Quest KACE Systems Deployment Appliance SMA version 11.0.273 Description The software uses a hardcoded symmetric encryption key to encrypt secrets within the MySQL databases. Because this key is not unique to each installation, an attacker wit...
MantisBT < 2.28.1 SOAP API Authentication Bypass (GHSA-phrq-pc6r-f6gh)
The version of MantisBT installed on the remote host is prior to 2.28.1. It is, therefore, affected by a vulnerability: - An authentication bypass vulnerability exists in the SOAP API due to improper type checking on the password parameter when running on MySQL family databases. Using a crafted...
CVE-2026-30849 MantisBT SOAP API has an authentication bypass vulnerability on MySQL
Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...
CVE-2017-18411
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account SEC-285...
EUVD-2017-9526
Malware in sbrugna...
EUVD-2017-9527
Malware in sbrugna...
EUVD-2025-28375
Malicious code in bioql PyPI...
EUVD-2022-30684
Malicious code in bioql PyPI...
CVE-2025-50858
Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter...
CVE-2025-50858: Improper Neutralization of Input During Web Page Generation
Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter...
CVE-2025-50858
Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter...
📄 Easy Hosting Control Panel 20.04.1.b Cross Site Scripting
Easy Hosting Control Panel version 20.04.1.b suffers from multiple reflective cross site scripting vulnerabilities. Exploit Title: Easy Hosting Control Panel EHCP 20.04.1.b - Reflected Cross-Site Scripting in the List MySQL Databases function via action parameter. Date: Aug 18, 2025 Exploit Autho...
