CVE-2026-43877 WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo.png. Its only access control is User::isLogged. It does not...

CVE-2026-43877 WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo.png. Its only access control is User::isLogged. It does not...

CVE-2026-42870

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

CVE-2026-42864

creationtimestamp| type| source ---|---|--- 2026-05-11 20:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wl32sv2z 2026-05-11 20:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wl32sv2z 2026-05-11 20:35:42+00:00| seen|...

CVE-2026-6146

creationtimestamp| type| source ---|---|--- 2026-05-11 19:47:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlm23hs5hc2s 2026-05-11 19:47:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlm23hs5hc2s 2026-05-11 21:34:10+00:00| seen|...

CVE-2026-45671

creationtimestamp| type| source ---|---|--- 2026-05-11 19:46:11+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-26g9-27vm-x3q8 2026-05-16 10:00:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxlm7v57a2n...

CVE-2026-8305

creationtimestamp| type| source ---|---|--- 2026-05-11 19:25:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllyue5x4y2q 2026-05-11 19:25:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllyue5x4y2q 2026-05-12 19:58:22+00:00| seen|...

CVE-2026-45005

creationtimestamp| type| source ---|---|--- 2026-05-11 19:15:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllychagb52q 2026-05-11 19:15:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllychagb52q...

CVE-2026-45003

creationtimestamp| type| source ---|---|--- 2026-05-11 19:03:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllxo3pxue2r 2026-05-11 19:03:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllxo3pxue2r...

CVE-2026-44997

creationtimestamp| type| source ---|---|--- 2026-05-11 18:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllx36epxz2r 2026-05-11 18:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllx36epxz2r...

CVE-2026-4892

creationtimestamp| type| source ---|---|--- 2026-05-11 18:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllwxdg4m32k 2026-05-11 18:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllwxdg4m32k 2026-05-12 09:24:59+00:00| seen|...

CVE-2026-44999

creationtimestamp| type| source ---|---|--- 2026-05-11 18:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllwqcnucd2p...

CVE-2026-4890

creationtimestamp| type| source ---|---|--- 2026-05-11 18:40:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllwemsz4v2c 2026-05-12 09:24:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnhr2mtcj2s 2026-05-13 12:31:36+00:00| seen|...

CVE-2026-42870 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

CVE-2026-42870

WeGIA is affected by a Stored XSS in versions prior to 3.7.0 at funcionario/profile_funcionario.php?id_funcionario=2, where an attacker can inject a payload into the Description field that is saved and later executed when the profile page is opened. CVSSv4 data assigns a base score of 6.4 (MEDIUM...

CVE-2026-42870 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

EUVD-2026-29185

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

CVE-2026-42870 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

EUVD-2026-29145

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed durin...

EUVD-2026-29089

A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogsnnrfnfmhandlenfprofile of the file lib/sbi/nnrf-handler.c of the component NRF. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to...