Lucene search
+L

108153 matches found

EUVD
EUVD
added 2026/08/05 6:37 a.m.6 views

EUVD-2026-53179

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

6.5CVSS5.8AI score0.00336EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/05 6:37 a.m.7 views

EUVD-2026-53178

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

6.1CVSS5.8AI score0.00804EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/05 6:37 a.m.36 views

CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

6.1CVSS0.00804EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/05 6:16 a.m.13 views

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

6.1CVSS0.0022EPSS
SaveExploits0References8
NVD
NVD
added 2026/08/05 6:16 a.m.12 views

CVE-2026-5062

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

4.9CVSS0.00266EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/05 5:27 a.m.9 views

EUVD-2026-53034

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

4.9CVSS5.8AI score0.00266EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/05 5:27 a.m.38 views

CVE-2026-5062 PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

4.9CVSS0.00266EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/05 5:27 a.m.12 views

CVE-2026-5062

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

4.9CVSS5.8AI score0.00266EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/05 5:27 a.m.41 views

CVE-2026-5062

CVE-2026-5062 affects PrettyLinks (WordPress plugin) versions up to and including 3.6.20. The vulnerability is an SQL injection via the 's' (search) parameter on the Pretty Links listing page, caused by insufficient escaping and lack of proper prepared statements in search_links_table(). It requi...

4.9CVSS5.8AI score0.00266EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/05 4:25 a.m.4 views

EUVD-2026-53040

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

6.1CVSS5.9AI score0.0022EPSS
SaveExploits0References8
ATTACKERKB
ATTACKERKB
added 2026/08/05 4:25 a.m.6 views

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

6.1CVSS5.9AI score0.0022EPSS
SaveExploits0References9
CVE
CVE
added 2026/08/05 4:25 a.m.36 views

CVE-2026-8790

CVE-2026-8790 affects the Football Pool WordPress plugin up to version 2.13.4. The issue is a Reflected Cross-Site Scripting in the Shoutbox widget, where the raw POST value of the shouttext parameter is echoed into a textarea via printf('%s', ...) without HTML escaping when a nonce check fails, ...

6.1CVSS5.9AI score0.0022EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/05 4:25 a.m.35 views

CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

7.5CVSS0.00388EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/05 4:17 a.m.9 views

CVE-2026-18898

A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to...

9CVSS0.00471EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/05 2:16 a.m.11 views

CVE-2026-18896

A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to launch the attack remotely. The exploit...

6.5CVSS0.00192EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/05 1:45 a.m.42 views

CVE-2026-18896

The CVE-2026-18896 entry concerns lavkush-maurya Student-Registration-System 1.0. The vulnerable component is an unknown function in /student/changepass.php, where manipulating the oldpass parameter enables SQL injection. This vulnerability is described as exploitable remotely and publicly disclo...

6.5CVSS6.5AI score0.00192EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/05 12:45 a.m.44 views

CVE-2026-18859 ESAFENET CDG usbkey;logindojojs sql injection

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be...

7.5CVSS0.00254EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/05 12:45 a.m.9 views

EUVD-2026-53016

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be...

7.5CVSS6.9AI score0.00254EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/04 9:16 p.m.10 views

CVE-2026-18812

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

8.6CVSS0.02261EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/04 8:30 p.m.32 views

CVE-2026-18812 H3C NX15 esps esps.ipv6.wan command injection

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

8.6CVSS0.02261EPSS
SaveExploits0References5
Rows per page
Query Builder