PT-2026-4899

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in yacy yacy search server source/net/yacy/http/servlets modules. This vulnerability is associated with program files YaCyDefaultServlet.Java. This issue affects yacy search server...

PT-2026-4855

beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with SYSTEM privileges...

CVE-2020-36974: Unquoted Search Path or Element

Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in 'C:\Program Files\IDT\WDM\AESTSr64.exe' to inject malicious code that would...

CVE-2020-36975: Unquoted Search Path or Element

EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by exploiting the service binary path. Attackers can leverage the unquoted path in 'C:\Program Files\Common Files\EPSON\EPW!3SSRP\ES60RPB.EXE' to...

CVE-2026-21408: Uncontrolled Search Path Element

beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with SYSTEM privileges...

PT-2026-63635

Уязвимость системы планирования и оперативного управления полётами OpenSky связана с непринятием мер по защите структуры запроса SQL при обработке параметра search. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнять произвольные SQL-запросы...

FUJIFILM Beat-Access code issue vulnerabilities

FUJIFILM beat-access is a remote access client software developed by Fujifilm, a Japanese company. FUJIFILM beat-access versions 3.0.3 and earlier have a code vulnerability that stems from issues with the DLL search path. This vulnerability may allow arbitrary code to be executed with SYSTEM...

PT-2026-4933

Name of the Vulnerable Software and Affected Versions Testa Online Test Management System version 3.4.7 Description The software contains a SQL injection issue. Attackers can manipulate database queries through the q search parameter. By injecting malicious SQL code into the search field, attacke...

CVE-2021-47902: Improper Neutralization of Special Elements used in an SQL Command

Testa Online Test Management System 3.4.7 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'q' search parameter. Attackers can inject malicious SQL code in the search field to extract database information, potentially accessing sensitive user...

Testa Online Test Management System SQL Injection Vulnerability

Testa Online Test Management System is an online examination software developed by the Malta-based company Testa. Version 3.4.7 of the Testa Online Test Management System has a SQL injection vulnerability. This vulnerability stems from incorrect handling of the search parameter “q”, and it may le...

EUVD-2025-206380

DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in the installer's search path...

CVE-2025-30248

DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in the installer's search path...

CVE-2025-30248

DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in the installer's search path...

CVE-2025-30248

CVE-2025-30248 involves DLL hijacking in the WD Discovery Installer for Western Digital WD Discovery on Windows (version 5.2.730). A local attacker can execute arbitrary code by placing a crafted DLL in the installer’s search path. The relevant connected sources confirm the vulnerable component i...

Untrusted Search Path

Overview @pnpm/fetching.binary-fetcher is a fetcher for binary archives Affected versions of this package are vulnerable to Untrusted Search Path via the extractZipToTarget function and the use of unvalidated prefix values. An attacker can overwrite arbitrary files on the file system by supplying...

CVE-2025-71178 Crucial Storage Executive < 11.08.082025.00 Installer DLL Preloading LPE

Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elevated privileges and loads Windows DLLs using an uncontrolled search path, which can cause a malicious DLL placed alongside the installer t...

CVE-2026-0776

Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in...

BIT-MOODLE-2025-3628 Moodle: moodle assignment submission search leaks anonymous student identities

A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities...

Exploit for Cross-Site Request Forgery (CSRF) in Internet-Formation Wp-Advanced-Search

CVE-2022-47447 POC CSRF - CVE-2022-47447 --- ⚠️ Uso exclu...

One privacy change I made for 2026 (Lock and Code S07E02)

This week on the Lock and Code podcast … When you hear the words "data privacy," what do you first imagine? Maybe you picture going into your social media apps and setting your profile and posts to private. Maybe you think about who you've shared your location with and deciding to revoke some of...