CVE-2026-55224

The MineAdmin backend management system is vulnerable to a path traversal flaw in its app-store plugin service prior to version 3.2.0-alpha.2 . The application fails to sanitize the user-supplied identifier parameter, concatenating it directly into filesystem paths within plugin/mine-admin/app-st...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

EUVD-2026-90209

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224: Improper Limitation of a Pathname to a Restricted Directory

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

Malicious Package

Overview capacitor-plugin-service-worker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

GHSA-59XM-4M8C-G3XJ MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall Summary The app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences e.g., ../ to read, install, or uninstall plugins from...

PT-2026-80225

Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall Summary The app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences e.g., ../ to read, install, or uninstall plugins from...

PT-2026-80765

Name of the Vulnerable Software and Affected Versions MineAdmin versions prior to 3.2.0-alpha.2 Description The app-store plugin service fails to sanitize the identifier variable before concatenating it into file system paths. This allows an attacker to use path traversal sequences, such as ../, ...

kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)

starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: OSV:PYSEC-2026-1552...

3lc (>=2.3.84, <=2.6.4), aiocronjob (>=0.6.0, <=0.7.0) +10 more potentially affected by CVE-2024-52581 via starlite (>=1.39.0, <=1.51.16)

starlite PYPI version =1.39.0, =2.3.84, =0.6.0, =0.4.0, =0.5.0, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.1.0, =0.8.1 - strawberry-graphql 0.168.0 Source cves: CVE-2024-52581 Source advisory: OSV:PYSEC-2026-1944...

CVE-2026-28427

CVE-2026-28427 affects OpenDeck (Linux software for the Elgato Stream Deck). Prior to version 2.8.1, the service listening on port 57118 serves static plugin files but does not sanitize path components properly. An attacker can use ../ sequences in the request path to traverse outside the intende...

3lc (>=2.3.84, <=2.6.4), aiocronjob (>=0.6.0, <=0.7.0) +10 more potentially affected by CVE-2024-52581 via starlite (>=1.39.0, <=1.51.16)

starlite PYPI version =1.39.0, =2.3.84, =0.6.0, =0.4.0, =0.5.0, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.1.0, =0.8.1 - strawberry-graphql 0.168.0 Source cves: CVE-2024-52581 Source advisory: GHSA-GJCC-JVGW-WVWJ...

kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)

starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: MEND:CVE-2024-32982...

kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)

starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: GHSA-83PV-QR33-2VCF...

kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)

starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: OSV:GHSA-83PV-QR33-2VCF...

WordPress Plugin Service Area Postcode Checker: Cross-site Scripting Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

kiara-plugin-service (>=0.4.0, <=0.4.7) potentially affected by CVE-2023-25578 +1 more via starlite (1.39.0)

starlite PYPI version 1.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlite and may be impacted: - kiara-plugin-service =0.4.0, =0.4.7 Source cves: CVE-2023-25578, CVE-2024-52581 Source advisory: OSV:GHSA-P24M-863F-FM6Q...

kiara-plugin-service (>=0.4.0, <=0.4.7) potentially affected by CVE-2023-25578 via starlite (1.39.0)

starlite PYPI version 1.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlite and may be impacted: - kiara-plugin-service =0.4.0, =0.4.7 Source cves: CVE-2023-25578 Source advisory: GHSA-P24M-863F-FM6Q...