CVE-2023-51769

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...

CVE-2026-81901: Missing Authorization

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2023-51769

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...

CVE-2023-51769

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...

CVE-2023-51769

Frappe before 14.49.0 is vulnerable to a Cross-Site Scripting (XSS) attack that affects blog pages and exception pages . The CVSS 3.1 score is 6.1 (MEDIUM) , with a network attack vector, low complexity, no privileges required, but user interaction required , and a changed scope leading to low im...

CVE-2023-51769: Improper Neutralization of Input During Web Page Generation

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...

EUVD-2023-60689

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...

PT-2026-91063

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...

CVE-2026-90700: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/proedit1.php. Such manipulation of the argument prodcode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed public...

CVE-2023-51769

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...

CVE-2026-90574: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90597: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/supedit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90600: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may b...

CVE-2026-85198: Improper Neutralization of Special Elements used in an SQL Command

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-89757

A flaw was found in the Linux kernel's memory management unit MMU, specifically within the multi-generational Least Recently Used mglru mechanism. A bug in how the kernel handles unevictable memory pages can lead to these pages remaining locked in memory even after they should be released. This c...

PT-2026-96603

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate pages batch migrate pages batch unmaps each folio before moving it, and every unmap runs the mmu notifier invalidate callbacks. On KVM hosts try to migrate ends up in kvm m...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37988)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper handling of the Username parameter in the /pages/ustransac.p...

Wagtail: Improper restriction handling on Pages admin API

ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...

PYSEC-2026-3939 Wagtail: Improper restriction handling on Pages admin API

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...

CVE-2026-84222: Exposure of Sensitive Information to an Unauthorized Actor

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...