23433 matches found
CVE-2025-69727
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components index.js and composeUrlImgPhotoIndividu allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to...
PT-2026-25694
Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...
educativa Campus Educativa 访问控制错误漏洞
Educativa Campus Educativa is an educational management platform owned by the Spanish company Educativa. Educativa Campus Educativa has a security vulnerability related to access control. This vulnerability stems from an insecure direct object reference in the file...
CVE-2025-69727
CVE-2025-69727 affects INDEX-EDUCATION PRONOTE
PT-2026-25793
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components index.js and composeUrlImgPhotoIndividu allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to...
Raytha CMS 跨站脚本漏洞
Raytha CMS is a content management system developed by the American company Raytha. Versions of Raytha CMS prior to 1.4.6 contained a cross-site scripting vulnerability. This vulnerability stemmed from the FirstName and LastName parameters in the profile editing function, which allowed for stored...
CVE-2026-4191
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...
CVE-2026-4191 JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...
CVE-2026-4191 JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...
CVE-2026-4191
CVE-2026-4191 affects JawherKl node-api-postgres (up to v2.5). The Profile Picture Handler’s index.js path.extname function is manipulated, causing unrestricted upload. Attack is remote and exploit has been published; vendor did not respond. No remediation details are provided in the supplied doc...
CVE-2026-28498
creationtimestamp| type| source ---|---|--- 2026-03-15 17:48:43+00:00| published-proof-of-concept| https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j 2026-03-18 23:00:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mheloq2uhh2h...
CVE-2026-27962
creationtimestamp| type| source ---|---|--- 2026-03-15 17:47:59+00:00| published-proof-of-concept| https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5 2026-03-22 07:00:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhmxw5omiy2w 2026-08-03 18:54:04+00:00| seen|...
OESA-2026-1549 wireshark security update
Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fixes: Wireshark ...
OESA-2026-1550 wireshark security update
Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fixes: Wireshark ...
CVE-2026-32812
creationtimestamp| type| source ---|---|--- 2026-03-15 09:44:28+00:00| published-proof-of-concept| https://github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73 2026-05-07 09:52:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlawyv57id2c...
PT-2026-25565
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and m...
CVE-2026-32771
creationtimestamp| type| source ---|---|--- 2026-03-14 14:26:39+00:00| published-proof-of-concept| https://github.com/ctfer-io/monitoring/security/advisories/GHSA-f7cq-gvh6-qr25 2026-03-20 02:23:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhhhjyk5tz2n...
CVE-2026-32722
creationtimestamp| type| source ---|---|--- 2026-03-13 22:01:26+00:00| published-proof-of-concept| https://github.com/bloomberg/memray/security/advisories/GHSA-r5pr-887v-m2w9 2026-03-20 09:00:06+00:00| seen| https://bsky.app/profile/concisecyber.bsky.social/post/3mhi5onwafp26...
Incorrect Authorization
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the browser.request. An attacker can modify or create browser profiles and persist unauthorized configuration changes by sending crafted requests to profile...
CVE-2026-32313
creationtimestamp| type| source ---|---|--- 2026-03-13 10:49:25+00:00| published-proof-of-concept| https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-4v26-v6cg-g6f9 2026-03-22 03:00:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhmkiyub4v2h...