19 matches found
CVE-2026-61671
WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the "/controle/control.php" dispatch endpoint accepts attacker-controlled "nomeClasse", "metodo", and record identifier parameters through "extract$REQUEST", including id, "idatendido",...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through improper validation of ownership in the editRecord process. An attacker can modify or overwrite DNS records in zones they do not own by manipulating the rid and zid parameters in ...
ECHO-43F0-7767-34D1
Bulletin has no description...
ECHO-32C7-8A8F-5DF3
Bulletin has no description...
EUVD-2026-4545
The LeadBI Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter of the 'leadbiform' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...
EUVD-2026-2899
WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed input. Attackers can trigger the vulnerability by copying a 300-character buffer of repeated 'A' characters into the mashREPL input field,...
EUVD-2025-206110
To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used...
MINI-H87X-V789-82W4
Bulletin has no description...
CVE-2021-43781
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default...
CVE-2025-1808
creationtimestamp| type| source ---|---|--- 2025-03-02 01:31:01+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6084 2025-03-02 02:30:38+00:00| published-proof-of-concept| Telegram/yqhHHpTMJThvOnMP9KSTnP0VqA7-wzWy3afb6m7cmgNDxD4 2025-03-02 04:23:54+00:00| seen|...
CVE-2024-48647
creationtimestamp| type| source ---|---|--- 2024-10-30 20:03:01+00:00| seen| https://t.me/cvedetector/9450 2025-10-01 18:11:56+00:00| seen| MISP/af790da0-9e28-4cb7-bd4e-46ad005115c6 2025-10-08 21:59:27+00:00| seen| MISP/af790da0-9e28-4cb7-bd4e-46ad005115c6...
GHSA-GH9F-6XM2-C4J2 SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User
Authentication would not be properly validated when an already authenticated scope user would use the use method or USE clause to switch working databases in a session. If there was a user record in the new database with identical record identifier as the original record that the user authenticat...
Microsoft Dynamics NAV Web Time and Expense Unauthorized Access
The vulnerability of the Web Time and Expense interface of the integrated enterprise management system Microsoft Dynamics NAV is related to the insecure direct object reference IDOR. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to arbitrar...
CVE-2017-1002009
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function...
MS:58B382CB-AC45-478E-B0FB-0F3265774402
2024-02 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 KB5034689...
MS:9CDBF3B2-969F-4471-B61C-F53E14555849
...
MS:1601B0D0-58B5-43F0-AA3D-672B0D7611E3
...