Lucene search
+L

108353 matches found

EUVD
EUVD
added 2026/07/20 6:24 p.m.17 views

EUVD-2026-46065

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter...

8.8CVSS5.8AI score0.01919EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/20 6:16 p.m.14 views

CVE-2026-26483

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

6.1CVSS0.00163EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/20 5:18 p.m.11 views

CVE-2026-64191

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

7.8CVSS0.00127EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/07/20 2:59 p.m.43 views

CVE-2026-26199 Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

5.9CVSS0.00256EPSS
SaveExploits1References2
NVD
NVD
added 2026/07/20 1:16 p.m.12 views

CVE-2026-16244

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

6.5CVSS0.002EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/20 12:15 p.m.18 views

CVE-2026-16244

The CVE-2026-16244 entry concerns itsourcecode Hospital Management System 1.0. The vulnerability affects the file /prescriptionorderreport.php where manipulation of the delid argument enables SQL injection. The issue is exploitable remotely, and the exploit has been publicly disclosed. Connected ...

6.5CVSS6.5AI score0.002EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/07/20 12:15 p.m.7 views

CVE-2026-16244

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

6.5CVSS6.5AI score0.002EPSS
SaveExploits0References6Affected Software1
Cvelist
Cvelist
added 2026/07/20 12:15 p.m.39 views

CVE-2026-16244 itsourcecode Hospital Management System prescriptionorderreport.php sql injection

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

6.5CVSS0.002EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/20 8:16 a.m.12 views

CVE-2026-2445

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

6.1CVSS0.00149EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/20 8:6 a.m.10 views

CVE-2026-2445

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

6.1CVSS5.4AI score0.00149EPSS
SaveExploits0References2Affected Software3
Cvelist
Cvelist
added 2026/07/20 8:6 a.m.44 views

CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

6.1CVSS0.00149EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/20 8:6 a.m.17 views

CVE-2026-2445

CVE-2026-2445 involves a reflected cross-site scripting (XSS) flaw in multiple WSO2 products where user-supplied input in a URL parameter is rendered without proper sanitization/encoding. The underlying issue is unsafe handling of URL parameters that can inject malicious JavaScript, enabling brow...

6.1CVSS5.5AI score0.00149EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/20 8:6 a.m.15 views

EUVD-2026-45898

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

6.1CVSS5.4AI score0.00149EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/20 7:16 a.m.17 views

CVE-2026-9833

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

7.1CVSS0.00164EPSS
SaveExploits1References1
NVD
NVD
added 2026/07/20 7:16 a.m.16 views

CVE-2026-12970

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

7.1CVSS0.00146EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/20 6:0 a.m.14 views

EUVD-2026-45893

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

7.1CVSS5.9AI score0.00164EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2026/07/20 6:0 a.m.40 views

CVE-2026-9833 Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

0.00164EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/07/20 6:0 a.m.6 views

CVE-2026-9833

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

5.8AI score0.00164EPSS
SaveExploits1References1
CVE
CVE
added 2026/07/20 6:0 a.m.21 views

CVE-2026-9833

CVE-2026-9833 affects the WordPress plugin Tag Groups prior to 2.2.0. The issue is a reflected XSS: an AJAX parameter is not properly escaped before being reflected in an HTML response, enabling an attacker to run arbitrary JavaScript in the browser of a logged-in user (Editor or higher) who is e...

7.1CVSS5.9AI score0.00164EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2026/07/20 6:0 a.m.40 views

CVE-2026-12970 LearnPress < 4.4.1 - Reflected XSS via c_search

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

0.00146EPSS
SaveExploits0References1
Rows per page
Query Builder