258887 matches found
CVE-2026-48030
Summary: CVE-2026-48030 affects pheditor (PHP) prior to 2.0.4. An OS command injection exists in the terminal action handler by unsafely using the POST parameter and injecting the directory path into shell_exec() without sanitization. This allows an authenticated user with terminal permission to ...
CVE-2026-48030 Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...
CVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...
CVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...
EUVD-2026-49369
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...
CVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...
CVE-2026-66398
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...
CVE-2026-59250
Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory and potentially achieve remote code execution or a denial-of-service crash by sending a single text-encoded H.248/Megaco message containing an oversized...
CVE-2026-51297
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2025-50455
SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...
CVE-2026-66398 phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...
CVE-2026-66398
CVE-2026-66398 affects phpMyFAQ releases before 4.1.6. Affected component: configuration API. Root cause: an authenticated administrator with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges can abuse upgrade.lastDownloadedPackage to write arbitrary PHP files. Attack flow: upload a malicious ZIP ...
CVE-2026-66398
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...
EUVD-2026-49331
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...
CVE-2026-66398 phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...
CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
CVE-2026-66396 SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...
CVE-2026-66396 SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...
CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
CVE-2026-66396 SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...