Lucene search
+L

109943 matches found

Positive Technologies
Positive Technologies
added 2026/06/15 12:00 a.m.26 views

PT-2026-49217

WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gatewa...

6.9CVSS5.4AI score0.00778EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/15 12:00 a.m.25 views

PT-2026-49295

Name of the Vulnerable Software and Affected Versions Tenda 5G03 version V05.03.02.04 Version 1.0 Description Command injection is possible in the action dial call function through the dialNumber parameter. Recommendations At the moment, there is no information about a newer version that contains...

9.8CVSS5.8AI score0.01046EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/15 12:00 a.m.39 views

PT-2026-49212

WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs...

5.3CVSS5.1AI score0.00103EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/15 12:00 a.m.26 views

PT-2026-49294

Name of the Vulnerable Software and Affected Versions Tenda 5G03 version V05.03.02.04 Version 1.0 Description Command injection is possible in the action radio on with ia apn function through the ia parameter. Command injection is a flaw that allows an attacker to execute arbitrary operating syst...

9.8CVSS6.2AI score0.01046EPSS
SaveExploits0References3
CVE
CVE
added 2026/06/15 12:00 a.m.26 views

CVE-2026-38064

Affected product: Tenda 5G03 V05.03.02.04 (Version 1.0). Vulnerability: command injection in the function action_dial_call via the dialNumber parameter. Root cause/detail: not explicitly described beyond the command injection vector; connected sources confirm the same description across EUVD-2026...

9.8CVSS5.3AI score0.01046EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/15 12:00 a.m.24 views

PT-2026-49292

Name of the Vulnerable Software and Affected Versions Tenda 5G03 version V05.03.02.04 Version 1.0 Description Command injection is possible in the action set volume function through the volume parameter. Recommendations At the moment, there is no information about a newer version that contains a...

9.8CVSS5.9AI score0.01046EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/15 12:00 a.m.40 views

PT-2026-49261

Name of the Vulnerable Software and Affected Versions Valhalla versions prior to 3.6.4 Description Reflected cross-site scripting XSS occurs due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the...

6.1CVSS5.9AI score0.00149EPSS
SaveExploits0References3
CVE
CVE
added 2026/06/15 12:00 a.m.30 views

CVE-2026-36670

CVE-2026-36670: Time-based blind SQL injection in the OpenSIPS Control Panel (opensips-cp) alias_management module before version 9.3.3. Authenticated attackers can leverage the table parameter in alias_management.php to execute arbitrary SQL. Connected sources confirm the affected component is O...

8.8CVSS6.3AI score0.00361EPSS
SaveExploits1References1
Positive Technologies
Positive Technologies
added 2026/06/15 12:00 a.m.30 views

PT-2026-49296

Name of the Vulnerable Software and Affected Versions Tenda 5G03 version V05.03.02.04 Version 1.0 Description Command injection is possible in the action ims on with apn function through the ims apn parameter. Recommendations At the moment, there is no information about a newer version that...

9.8CVSS5.8AI score0.01345EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/15 12:00 a.m.34 views

PT-2026-49288

Name of the Vulnerable Software and Affected Versions OpenSIPS Control Panel versions prior to 9.3.3 Description A Time-Based Blind SQL Injection in the alias management module allows authenticated attackers to execute arbitrary SQL commands. This occurs via the 'table' GET parameter in the 'alia...

8.8CVSS6.2AI score0.00361EPSS
SaveExploits1References3
GithubExploit
GithubExploit
added 2026/06/14 3:17 p.m.139 views

Exploit for Improper Handling of Length Parameter Inconsistency in Mongodb

CVE-2025-14847-mongobleed CVE-2025-14847 mongobleed python fil...

8.7CVSS6AI score0.83218EPSS
SaveExploits39
Positive Technologies
Positive Technologies
added 2026/06/14 12:00 a.m.34 views

PT-2026-49134

Name of the Vulnerable Software and Affected Versions Linux-PAM versions prior to 1.7.3 Description A timing discrepancy exists in the pam userdb module's plaintext-password comparison path within modules/pam userdb/pam userdb.c. A local or network-adjacent attacker can recover the plaintext...

8.2CVSS5.3AI score0.00333EPSS
SaveExploits0References40
CVE
CVE
added 2026/06/13 11:15 p.m.47 views

CVE-2026-12176

SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 contains a cross-site scripting (XSS) vulnerability in an unknown function of the file /index.php when the action parameter is manipulated. The attack is remote and has been publicly disclosed . Exploit maturity is label...

5.3CVSS3.7AI score0.00265EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/06/13 4:34 p.m.12 views

CVE-2026-6428 Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter

SQL Injection in reports/catalogueout.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary da...

7.6CVSS9.1AI score0.00244EPSS
SaveExploits0References3
CVE
CVE
added 2026/06/13 4:34 p.m.76 views

CVE-2026-6428

CVE-2026-6428 describes an SQL injection in Koha’s reports/catalogue_out.pl up to versions 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00. The vulnerability arises from a vulnerable sink that concatenate...

7.6CVSS9.1AI score0.00244EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/13 4:34 p.m.11 views

CVE-2026-6428 Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter

SQL Injection in reports/catalogueout.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary da...

6.1CVSS5.9AI score
SaveExploits0References7
OSV
OSV
added 2026/06/13 8:46 a.m.42 views

BIT-MYSQL-CLIENT-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrepnotifycmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in...

10CVSS5.5AI score0.01582EPSS
SaveExploits0References16
OSV
OSV
added 2026/06/13 8:45 a.m.25 views

BIT-MONGODB-2026-9751 Sensitive data could be written to mongod.log

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text...

6.8CVSS5.2AI score0.00109EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/13 8:16 a.m.30 views

CVE-2026-9629

The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

6.4CVSS0.00199EPSS
SaveExploits0References6
CVE
CVE
added 2026/06/13 7:51 a.m.45 views

CVE-2026-9629

The Canvas plugin for WordPress (Canvas) contains a Stored Cross-Site Scripting vulnerability via the 'tag' parameter in all versions up to 2.5.2 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject scripts that e...

6.4CVSS5.6AI score0.00199EPSS
SaveExploits0References6
Rows per page
Query Builder