90289 matches found
CVE-2025-70040: Insertion of Sensitive Information into Log File
An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2. This allows an attacker to obtain sensitive information...
CVE-2026-3767: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in itsourcecode sanitize or validate this input 1.0. Affected is an unknown function of the file /admin/teacher-attendance.php. Executing a manipulation of the argument teacherid can lead to sql injection. The attack may be launched remotely. The exploit has been ma...
WordPress plugin HUMN-1 AI Website Scanner & Human Certification by Winston AI 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
CVE-2026-30830: Improper Neutralization of Input During Web Page Generation
Defuddle cleans up HTML pages. Prior to version 0.9.0, the findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event...
CVE-2026-1981: Missing Authorization
The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the winstondisconnect function in all versions up to, and including, 0.0.3. This makes it possible for authenticated...
CVE-2026-28722: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 Windows before build 41186...
CVE-2026-28724: Incorrect Authorization
Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 41186...
CVE-2026-28723: Incorrect Authorization
Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 41186...
CVE-2026-27027: Insufficiently Protected Credentials
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-28714: Insufficiently Protected Credentials
Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 41186...
CVE-2026-28709: Incorrect Authorization
Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 41186...
CVE-2026-28712: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 Windows before build 41186...
CVE-2026-27138: Undefined Security Weakness
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS...
CVE-2026-29065: Improper Limitation of a Pathname to a Restricted Directory
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4...
CVE-2026-24696: Improper Restriction of Excessive Authentication Attempts
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...
CVE-2026-20882: Improper Restriction of Excessive Authentication Attempts
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...
CVE-2026-28717: Incorrect Default Permissions
Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 Windows before build 41186...
CVE-2026-27778: Improper Restriction of Excessive Authentication Attempts
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...
CVE-2026-28715: Incorrect Authorization
Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 41186...