CVE-2026-81915: Missing Authorization

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...

CVE-2026-38579

Multiple reflected Cross-Site Scripting XSS vulnerabilities in damasac thaipalliativelte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter line 24, the id parameter lines 25, 75, and the ptidkey parameter lines 26, 42 in...

CVE-2026-38579

Multiple reflected Cross-Site Scripting XSS vulnerabilities in damasac thaipalliativelte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter line 24, the id parameter lines 25, 75, and the ptidkey parameter lines 26, 42 in...

EUVD-2017-9093

Malware in sbrugna...

Cells Blog SQL Injection Vulnerability

Cells Blog is a free but powerful mini blogging system. Cells Blog 3.5 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by using the pubreadpost.php ptid parameter to conduct a SQL injection attack...

CVE-2017-17950

Cells Blog 3.5 has SQL Injection via the pubreadpost.php ptid parameter...

Sql injection

Cells Blog 3.5 has SQL Injection via the pubreadpost.php ptid parameter...

CVE-2017-17950

CVE-2017-17950 affects Cells Blog 3.5, where the pub_readpost.php ptid parameter enables SQL injection via user-supplied input. The vulnerability’s impact is described in multiple sources (e.g., NVD and CNVD) as allowing unauthorized access to data with partial to high severity. Exploitation deta...