DEBIAN-CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

CVE-2026-114720

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to an IMAP command injection vulnerability. A remote authenticated attacker can exploit this by injecting CRLF sequences into the _flag parameter of the mail/mark action , allowing for the execution of arbitrary IMAP c...

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

VulnCheck KEV: CVE-2017-20289

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

VulnCheck KEV: CVE-2020-37284

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...

VulnCheck KEV: CVE-2018-25438

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

VulnCheck KEV: CVE-2019-25779

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...

VulnCheck KEV: CVE-2024-58393

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

CVE-2026-107079

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcodeauth.html component...

EUVD-2026-108206

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcodeauth.html component...

Linux Distros Unpatched Vulnerability : CVE-2026-114720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this...

PT-2026-121668

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user can exploit improper validation of the time zone parameter to cause the /etc/localtime file to point to a location outside the intended...

VulnCheck KEV: CVE-2018-25439

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the strreplace filter to read files like...

PT-2026-120951

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::get uids without constraining the input mode, so values re-read inside that...

PT-2026-120952

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

VulnCheck KEV: CVE-2022-51023

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

PT-2026-121353

Name of the Vulnerable Software and Affected Versions i-Netsolution Readymade Unilevel Ecommerce MLM version 2024-03-15 build Description An SQL injection flaw allows unauthenticated attackers to manipulate database queries. Attackers can extract database information by sending GET requests to th...