Lucene search
+L

108122 matches found

CVE
CVE
added 2 days ago28 views

CVE-2026-19335

CVE-2026-19335 concerns the Jane-xiaoer skill-vision-control project, affecting the function getSkillVersionsDir in src/svc/utils/config.ts. The vulnerability arises from how the argument skillName is handled, enabling a path traversal condition. The issue is restricted to a local attack vector a...

5.3CVSS5.5AI score0.00173EPSS
SaveExploits0References6
EUVD
EUVD
added 2 days ago9 views

EUVD-2026-54837

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

5.3CVSS5.5AI score0.00137EPSS
SaveExploits0References6
Cvelist
Cvelist
added 3 days ago38 views

CVE-2026-19281 adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection

A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack ...

5.3CVSS0.00624EPSS
SaveExploits0References6
Nuclei
Nuclei
added 3 days ago22 views

LoLLMS WebUI < 9.8 - Path Traversal

parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /listpersonalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter. id: CVE-2024-4322 info: name: LoLLMS WebUI 9.8 - Path Traversal...

7.5CVSS7.4AI score0.30987EPSS
SaveExploits1References2
Nuclei
Nuclei
added 3 days ago99 views

F-logic DataCube3 - SQL Injection

SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the reqid parameter. id: CVE-2024-31750 info: name: F-logic DataCube3 - SQL Injection author: DhiyaneshDK severity: high description: | SQL injection vulnerability in f-logic...

9.8CVSS5.6AI score0.1927EPSS
SaveExploits1References5
Nuclei
Nuclei
added 3 days ago74 views

SuperWebmailer 7.21.0.01526 - Remote Code Execution

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection. id: CVE-2020-11546 info: name: SuperWebmailer...

9.8CVSS9.7AI score0.32841EPSS
SaveExploits1References5
EUVD
EUVD
added 3 days ago10 views

EUVD-2026-54732

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

5.2AI score0.00172EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 3 days ago9 views

CVE-2026-16535

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

5.2AI score0.00172EPSS
SaveExploits0References1
CVE
CVE
added 3 days ago39 views

CVE-2026-16282

The CVE describes a vulnerability in the Appointment Hour Booking WordPress plugin prior to version 1.5.88 where a missing validation of a client-supplied booking price against the server-side service price allows unauthenticated users to submit arbitrary final prices (including zero or negative)...

5.4AI score0.00136EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago9 views

EUVD-2026-54578

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

5.3CVSS5.3AI score0.00291EPSS
SaveExploits0References3
Cvelist
Cvelist
added 4 days ago29 views

CVE-2026-19211 SourceCodester Photo Share Website ajax.php signup sql injection

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made publ...

7.5CVSS0.00263EPSS
SaveExploits0References6
EUVD
EUVD
added 4 days ago8 views

EUVD-2026-54509

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

5.1CVSS3.6AI score0.00199EPSS
SaveExploits0References6
CVE
CVE
added 4 days ago35 views

CVE-2026-19209

SourceCodester Photo Share Website 1.0 contains a cross-site scripting (XSS) flaw in the unknown function handling the Comment argument of /social/index.php?page=home. The flaw can be triggered remotely, and an exploit has been published. The connected sources confirm the vulnerability, its locat...

5.1CVSS3.6AI score0.00199EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 4 days ago10 views

CVE-2026-19209

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

5.1CVSS3.6AI score0.00199EPSS
SaveExploits0References6Affected Software1
NVD
NVD
added 4 days ago10 views

CVE-2026-19207

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploi...

4.8CVSS0.0021EPSS
SaveExploits0References6
CVE
CVE
added 4 days ago37 views

CVE-2026-19207

Summary: PHPGurukul Company Visitor Management System 1.0 is affected by an input handling flaw in /manage-newvisitors.php where manipulating the fullname parameter enables cross-site scripting. The vulnerability can be triggered remotely and the exploit has been publicly disclosed. The documents...

4.8CVSS3.3AI score0.0021EPSS
SaveExploits0References6
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-19207 PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploi...

4.8CVSS0.0021EPSS
SaveExploits0References6
EUVD
EUVD
added 4 days ago11 views

EUVD-2026-54496

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploi...

4.8CVSS3.2AI score0.0021EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
added 4 days ago9 views

CVE-2026-50629

A flaw was found in apache-cxf. The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without proper sanitization. A remote attacker could exploit this by injecting arbitrary content, including fake log entries, into the server's log...

5.3CVSS5.5AI score0.0047EPSS
SaveExploits0References5
NVD
NVD
added 4 days ago12 views

CVE-2026-54214

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

5.3CVSS0.00335EPSS
SaveExploits0References2
Rows per page
Query Builder