CVE-2026-94451

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

CVE-2026-109354 LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...

EUVD-2026-97656

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...

CVE-2026-109354

LibreNMS versions prior to 26.9.0 are vulnerable to a path traversal vulnerability in the nfsen_channel_common.inc.php component. This flaw allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. An attacker with access to a single NFSen-ena...

CVE-2026-109354 LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...

CVE-2026-109354 LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...

CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-109327

The Admidio application (versions 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the system/redirect.php component. The root cause is an incomplete fix for CVE-2021-43810, allowing unauthenticated attackers to inject JavaScript via ...

CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-109327

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

EUVD-2026-97629

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

Payload CMS SQL injection vulnerability

Payload CMS versions prior to 3.90.0 and 4.0.0-canary.0 through 4.0.0-canary.34 contain an SQL injection vulnerability. This vulnerability stems from improper handling of the “in” and “notin” query parameters provided by users, which may allow authenticated attackers to execute SQL injection...

Ravi Teja Online-Examination-System Input Verification Error Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from incorrect handling of the branch parameter in the include/database.php file, which may lead to SQL injection attacks...

CVE-2026-103527

Thelia v2.6.0's Smarty templates address.html and address-update.html fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting XSS when an authenticated user visits the malicious link containing attacker‑controlled JavaScript...

CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

CVE-2026-103527

Thelia v2.6.0 is vulnerable to reflected Cross-Site Scripting (XSS) due to improper escaping of double quotes in the “next” parameter within the Smarty templates (address.html and address-update.html ). An authenticated user can be tricked into visiting a malicious link containing attacker-contro...

CVE-2026-103523 CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

CVE-2026-103523

Thelia v2.6.0 is susceptible to an open redirect vulnerability within its address creation workflow. When a user submits the "Add New Address" form via a crafted URL, the application redirects the user to a destination specified in the next parameter. The vulnerability exists because the applicat...

EUVD-2026-97476

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...