Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

Alfresco Share - Open Redirect

Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-14223 info: name:...

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

PuneethReddyHC action.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. id: CVE-2021-41648 info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high descriptio...

WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting

WordPress Post Status Notifier Lite plugin before 1.10.1 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

Post SMTP <= 3.6.0 - Email Log Disclosure

Post SMTP WordPress plugin = 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication. id: CVE-2025-11833 info: name: Post SMTP = 3.6.0 -...

WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload

The Frontend File Manager plugin 4.0 and N-Media Post Front-end Form plugin 1.1 for WordPress were vulnerable to arbitrary file uploads due to missing file type validation. This allowed unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. id:...

Combo Blocks < 2.2.76 - Improper Access Control

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts id:...

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. id: CVE-2017-17059 info: name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress...

CVE-2026-18907

creationtimestamp| type| source ---|---|--- 2026-08-05 02:42:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/iz6wskxiikwcm...

CVE-2026-18896

creationtimestamp| type| source ---|---|--- 2026-08-05 02:36:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bpk4apcdf5lm7...

CVE-2026-18856

creationtimestamp| type| source ---|---|--- 2026-08-05 02:27:48+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msci47xh4s2g...

CVE-2026-67861

creationtimestamp| type| source ---|---|--- 2026-08-05 00:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msc7va7zon2g...

CVE-2026-45537

creationtimestamp| type| source ---|---|--- 2026-08-04 23:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msc5bssods2l 2026-08-05 00:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msc7uzkyb62l 2026-08-05 03:22:39+00:00| seen|...

CVE-2026-70594

creationtimestamp| type| source ---|---|--- 2026-08-04 22:36:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6f6e3y6mttsbe 2026-08-05 01:31:27+00:00| seen| https://gist.github.com/alon710/a8f899d9b938031c01419f5cf3be4d0e...

CVE-2026-18813

creationtimestamp| type| source ---|---|--- 2026-08-04 21:49:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2lkjejcezmnlb...

EUVD-2026-39023

Ghost: Mobiledoc image-size fetch SSRF...

CVE-2026-70554

creationtimestamp| type| source ---|---|--- 2026-08-04 21:14:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbwlcivoa2s 2026-08-04 22:07:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j74eipql3yfb6 2026-08-05 00:00:37+00:00| seen|...

CVE-2026-70478

creationtimestamp| type| source ---|---|--- 2026-08-04 21:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbwlb3shi23 2026-08-05 03:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117040665415933315 2026-08-05 03:00:27+00:00| seen|...