357484 matches found
CVE-2025-63607
TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...
EUVD-2025-210815
TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...
Important: postgresql17
Issue Overview: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the...
Linux Distros Unpatched Vulnerability : CVE-2026-82853
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is...
CVE-2026-14696: Missing Release of Memory after Effective Lifetime
When Ethernet bridging is enabled CONFIGNETETHERNETBRIDGE, ethbridgeinputprocess in subsys/net/l2/ethernet/bridge/bridgeinput.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called ethbridgehandlelocall...
CVE-2026-78079: URL Redirection to Untrusted Site
Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...
CVE-2026-82853: Improper Neutralization of CRLF Sequences
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...
CVE-2025-63607: Improper Neutralization of Input During Web Page Generation
TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...
PT-2026-83731
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...
CVE-2026-75133: Missing Authentication for Critical Function
Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...
CVE-2026-75132: Improper Neutralization of Special Elements used in an SQL Command
WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...
CVE-2026-66047: Missing Authentication for Critical Function
ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...
PT-2026-84049
Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.8 Description Tornado parses application/x-www-form-urlencoded request bodies using urllib.parse.parse qs in tornado/escape.py without specifying the max num fields parameter. The process occurs within...
Amazon Linux 2023 : postgresql17, postgresql17-contrib, postgresql17-llvmjit (ALAS2023-2026-2076)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2076 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...
PT-2026-83848
Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.2 Description An unauthenticated remote code execution issue exists in the ProfilePress WordPress plugin. Unauthenticated attackers can install and activate arbitrary plugins by brute-forcing a weak 32-bit...
PT-2026-83843
Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...
C-MOR 6.0104 - Cross-Site Scripting (XSS)
Exploit Title: C-MOR 6.0104 - Cross-Site Scripting XSS Google Dork: N/A Date: 2026-07-23 Exploit Author: Samir Shamdin Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link: https://www.c-mor.com/ Version: = 6.0104 Tested on: C-MOR Video Surveillance V6.0104 CVE: CVE-2026-51133 1...
CubeCart 6.7.4 - Cross-Site Scripting
Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting Attribute Injection in gui.class.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE:...
CVE-2026-75460
XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...
