Lucene search
+L

108640 matches found

Cvelist
Cvelist
added 2026/07/01 3:11 p.m.47 views

CVE-2026-57517 Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...

9.8CVSS0.01151EPSS
SaveExploits2References3
Debian CVE
Debian CVE
added 2026/07/01 2:51 p.m.11 views

CVE-2026-58037

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php,...

6.1CVSS5.8AI score0.00169EPSS
SaveExploits1
EUVD
EUVD
added 2026/07/01 1:45 p.m.15 views

EUVD-2026-40995

We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: The payment integration plugins Stripe included in the core system, pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone, pretix-secuconnect,...

9.4CVSS6AI score0.00271EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/01 1:18 p.m.13 views

EUVD-2026-40958

The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the payment provider back to o...

10CVSS5.8AI score0.00288EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/01 1:18 p.m.8 views

CVE-2026-13603 SSRF with API key leak in pretix-oppwa

The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the payment provider back to o...

10CVSS6AI score
SaveExploits0References5
CVE
CVE
added 2026/07/01 11:29 a.m.60 views

CVE-2026-14198

The CVE-2026-14198 entry concerns @fastify/middie versions 9.1.0–9.3.2, where encoded slashes (%2F) in path parameter values are decoded by middie but not by Fastify’s router during route lookup. This mismatch lets a crafted URL bypass middleware-based security (authentication/authorization/rate ...

9.1CVSS5.8AI score0.00299EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/07/01 11:29 a.m.17 views

EUVD-2026-40946

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

9.1CVSS5.8AI score0.00299EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/01 11:16 a.m.19 views

CVE-2026-12142

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

7.2CVSS0.00304EPSS
SaveExploits0References14
NVD
NVD
added 2026/07/01 11:16 a.m.14 views

CVE-2026-10095

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00234EPSS
SaveExploits0References11
NVD
NVD
added 2026/07/01 10:16 a.m.17 views

CVE-2026-13454

The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

6.5CVSS0.00261EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/01 10:16 a.m.18 views

CVE-2026-12754

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

6.1CVSS0.00215EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/01 9:32 a.m.37 views

CVE-2026-12142

CVE-2026-12142 affects the NEX-Forms – Ultimate Forms Plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) via the internal parameter named '_name[]' , present in all versions up to and including 9.2.2 . Root cause: insufficient input sanitization and output escaping, co...

7.2CVSS5.9AI score0.00304EPSS
SaveExploits0References14
ATTACKERKB
ATTACKERKB
added 2026/07/01 9:32 a.m.14 views

CVE-2026-12142

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

7.2CVSS5.9AI score0.00304EPSS
SaveExploits0References15
ATTACKERKB
ATTACKERKB
added 2026/07/01 9:32 a.m.14 views

CVE-2026-10095

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS5.9AI score0.00234EPSS
SaveExploits0References12
CVE
CVE
added 2026/07/01 8:30 a.m.40 views

CVE-2026-12754

The CVE concerns the VikBooking Hotel Booking Engine & PMS plugin for WordPress, vulnerable to Reflected Cross-Site Scripting via the layoutstyle parameter in all versions up to and including 1.8.12. The root cause is insufficient input sanitization and output escaping, allowing unauthenticated a...

6.1CVSS5.9AI score0.00215EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/01 8:30 a.m.13 views

EUVD-2026-40939

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

6.1CVSS5.9AI score0.00215EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/01 8:30 a.m.43 views

CVE-2026-12754 VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

6.1CVSS0.00215EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/01 8:30 a.m.12 views

EUVD-2026-40938

The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

6.5CVSS5.8AI score0.00261EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/01 8:30 a.m.29 views

CVE-2026-13454

CVE-2026-13454 affects MotoPress Appointment Booking for WordPress (

6.5CVSS5.8AI score0.00261EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/01 8:16 a.m.15 views

CVE-2026-10096

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'pageid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, t...

4.3CVSS0.00196EPSS
SaveExploits0References5
Rows per page
Query Builder