CVE-2026-110882 WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1...

CVE-2026-110882

The SMS Alert Order Notifications plugin (developed by Cozy Vision Technologies Pvt. Ltd. ) for WordPress is susceptible to a Missing Authorization vulnerability (CWE-862). This issue affects versions through 4.0.1 and allows an attacker to exploit Incorrectly Configured Access Control Security L...

CVE-2026-101110

CVE-2026-101110 — OrdaSoft Book Library Free unauthenticated SQL injection Python 3 PoC for CVE-2026-101110 — OrdaSoft Book Library Free for Joomla ≤ 6.4.6. Upgrade to 6.4.7+. | ---|--- PoCbit| https://pocbit.org/pocs/cve-2026-101110 Catalog| https://pocbit.org/pocs/ Component| combooklibrary Fil...

CVE-2024-39069

ifood Order Manager 'Gestor de Peddios.exe' - DLL hijacking An attacker places a malicious DLL named "d3d12.dll" in a directory that is searched by the application before the legitimate "d3d12.dll" is found. When the application is launched, it loads the malicious DLL instead of the legitimate on...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ Blind SQL injection Must Have sqlmap installed & a valid username & password with subscriber+ Usage usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w UR...

azurelinux

Azure Linux 4 An open-source Linux distribution built and optimized forAzure, with sources derived from Fedora Linux. Azure Linux provides a secured, reliable operating system for virtual machines, containers, and bare-metal platforms. Azure Linux is built on a robust open-source foundation from...

DLLHSC

DLLHSC DLL Hijack SCanner - A tool to generate leads and automate the discovery of candidates for DLL Search Order Hijacking Index of this page Contents of this repository Modes of operation Compile and Run Guidance Help menu Example Runs Feedback Contents of this repository This repository hosts...

meltdown

Meltdown Proof-of-Concept This repository contains several applications, demonstrating the Meltdown bug. For technical information about the bug, refer to the paper: Meltdown by Lipp, Schwarz, Gruss, Prescher, Haas, Mangard, Kocher, Genkin, Yarom, and Hamburg The applications in this repository a...

iscsicpl_bypassUAC

iscsicpl autoelevate DLL Search Order hijacking UAC Bypass 0day The iscsicpl.exe binary is vulnerable to a DLL Search Order hijacking vulnerability when running 32bit Microsoft binary on a 64bit host via SysWOW64. The 32bit binary, will perform a search within user %Path% for the DLL iscsiexe.dll...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

CVE-2022-32132

CVE-2022-32132 for osTicket | Support Ticketing System Reflected XSS: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...

ir-rescue

ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...

CVE-2026-100316

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.36.10 . The root cause is insufficient input sanitization and output escaping regarding the CF-IPCountry Header . Unauthenticated att...

EUVD-2026-103277

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103376 PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-103376

The PeachPay — Payments & Express Checkout for WooCommerce WordPress plugin, versions prior to 1.120.70 , is vulnerable to an unauthenticated order key disclosure. The root cause is a lack of capability or ownership checks when the plugin responds to an unauthenticated request by returning an ord...

EUVD-2026-103255

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

Purchase Order Management v1.0 - SQL Injection

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/viewdetails.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

Purchase Order Management v1.0 - Cross Site Scripting (Reflected)

Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the password parameter at /purchaseorder/classes/login.php. id: CVE-2023-29623 info: name: Purchase Order Management v1.0 - Cross Site Scripting Reflected author: theamanrawat severity:...