Roundcube Webmail Project: Roundcube Webmail Input Validation Vulnerability

The Roundcube Webmail Project: There is a vulnerability in Roundcube Webmail versions prior to 1.6.20 and 1.7.5, specifically versions under 1.7.x. This vulnerability stems from IMAP command injection. A remotely authenticated attacker can execute arbitrary IMAP commands by injecting CRLF sequenc...

WordPress Custom Tables: Cross-site Scripting Vulnerabilities

Versions of WordPress Custom Tables prior to 3.4.6 contained a cross-site scripting vulnerability. This vulnerability stemmed from the uncleaned key parameter in the iframe.php file. It could lead to reflective XSS attacks. Unauthenticated attackers could construct GET requests to execute scripts...

WordPress Aspose Doc Exporter path traversal vulnerability

Versions of Aspose Doc Exporter 2.0 prior to version 2.0 contain a path traversal vulnerability. This vulnerability arises from the lack of cleaning the path passed to the readfile function. Unauthenticated attackers can download arbitrary files by sending a GET request with the file parameter...

Aspose PDF Exporter path traversal vulnerability

Versions of Aspose PDF Exporter 2.0 prior to version 2.0 have a path traversal vulnerability. This vulnerability stems from the use of the file parameter, which is not properly cleaned up when passed to the readfile function. This allows for path traversal attacks; unauthenticated attackers can...

Apostrophe Technologies ApostropheCMS has a vulnerability related to improper output processing.

Apostrophe Technologies' ApostropheCMS has a vulnerability in its output processing. This vulnerability stems from the fact that these CAPTCHA integrations insert unencoded response tokens provided by users into provider validation requests. This can lead to request parameter injection, disruptio...

ProjectDiscovery Nuclei Templates Cross-Site Script Vulnerabilities

Versions of ProjectDiscovery Nuclei Templates prior to 1.1.1 contained a cross-site scripting vulnerability. This vulnerability stemmed from uncleaned input of the ff parameter, making it susceptible to reflective cross-site scripting attacks. Such attacks could execute scripts and steal session...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

Automotive Shop Management System 1.0 SQL Injection

Automotive Shop Management System version 1.0 suffers from a remote SQL injection vulnerability. Titles: Automotive Shop Management System 1.0 Multiple SQLi Author: nu11secur1ty Date: 10/19/26 Vendor: https://github.com/oretnom23 Software:...

PT-2026-118029

Nginx UI: Node Secret Credential Exposure via URL Query Parameter in github.com/0xJacky/Nginx-UI...

PT-2026-118041

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

PT-2026-118071

Casdoor SSO callback uses a constant state parameter login CSRF in github.com/0xJacky/Nginx-UI...

CVE-2026-112027

A flaw was found in the Uploadify component of light0011 cms. A remote attacker can exploit an improper input handling vulnerability by manipulating the filename parameter in the check-exists script. This issue leads to information disclosure, allowing the attacker to verify the existence of...

Diem project: Diem input validation error vulnerability

The Diem project has a vulnerability in input validation. This vulnerability stems from improper handling of the Referer parameter in the Sign-In component in the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php. It may lead to redirection, and attackers could...

BlackBelt Technology PI Dashboard: Input validation error vulnerability

The BlackBelt Technology PI Dashboard versions prior to 0.8.0 have a vulnerability related to input validation errors. This vulnerability stems from improper handling of the cwd parameter by the unknown function in the WebSocket Gateway component, resulting in source validation errors that can be...

Chamilo LMS cross-site scripting vulnerabilities

Chamilo LMS versions 1.11.40 and earlier, 2.0.3 and earlier, as well as 3.0.1 and earlier, have a security vulnerability. This vulnerability stems from the incorrect handling of the parameter Name in the TicketManager::addProject function within the main/inc/lib/TicketManager.php file in the Tick...

AI Genius Automations has a serious information leakage vulnerability

AI Genius Automations versions 1.0.87 and earlier have a security vulnerability. This vulnerability stems from improper handling of the parameter path in the fileserver/src/index.ts file, which may lead to information leakage...

DeepPavlov Team: Vulnerability in input validation

The DeepPavlov team has identified a security vulnerability in versions of DeepPavlov 1.7.0 and earlier. This vulnerability stems from incorrect handling of the processor parameter in the init function of the deeppavlov/models/preprocessors/multitaskpreprocessor.py file. It may lead to remote cod...

Subhajitkhan Online-Clinic-Management-System Cross-Site Script Vulnerability

The subhajitkhan online-clinic-management-system has a security vulnerability. This vulnerability stems from incorrect handling of the msg parameter in the feedback.php file, which may lead to cross-site scripting attacks...

H3C Magic NX15 has a vulnerability in input validation.

The H3C Magic NX15 NX15V100R017 version has a security vulnerability. This vulnerability stems from the improper handling of the path parameter in the write function of the RPC Interface component. This could lead to code injection, allowing attackers to execute attacks remotely...

Unsloth AI has a code injection vulnerability.

Unsloth AI versions 0.1.501-beta and earlier have a code injection vulnerability. This vulnerability stems from the operation of the parameter Type in the function FastSentenceTransformer.istransformermoduleref in the file unsloth/models/sentencetransformer.py. Using an externally controlled inpu...