CVE-2020-36919: Improper Neutralization of Input During Web Page Generation

WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser...

PT-2026-2744

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description An issue exists in Microsoft Office where an untrusted search path can allow an unauthorized attacker to execute code locally. Recommendations At the moment, there is no information...

CVE-2022-50901: Unquoted Search Path or Element

Wondershare Dr.Fone 11.4.9 contains an unquoted service path vulnerability in the DFWSIDService that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files x86\Wondershare\Wondershare Dr.Fone\ to inject malicious executables that woul...

Hikvision NVR/DVR Devices 安全漏洞

Hikvision NVR/DVR Devices are a series of network cameras from Hikvision, a Chinese company. A security vulnerability exists in Hikvision NVR/DVR Devices that stems from a stack overflow in the device's search and discovery function, which could allow an attacker on the same LAN to cause the devi...

CVE-2022-50924: Unquoted Search Path or Element

Private Internet Access 3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with...

PT-2026-2357

Name of the Vulnerable Software and Affected Versions WPForms version 1.7.8 Description The software contains a cross-site scripting issue in the slider import search feature and tab parameter. An attacker can inject malicious scripts through the /ListTable.php endpoint to execute arbitrary...

CVE-2026-20943: Untrusted Search Path

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2022-50917: Unquoted Search Path or Element

ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path by placing malicious executables in specific file system locations to gain elevated...

CVE-2023-53984: Unquoted Search Path or Element

Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows local non-privileged users to potentially execute code with system privileges. Attackers can exploit the misconfigured service path to inject and execute arbitrary code by placing...

MiracleLinux 7 : xorg-x11-server-1.20.4-99.0.1.el7.AXS7 (AXSA:2025-10843:03)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10843:03 advisory. CVE-2025-26594: refuse to free the root cursor and keep its ref CVE-2025-26595: fix buffer overflow in XkbVModMaskText CVE-2025-26596: xkb: fix...

CVE-2025-67146

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in 1 membersearch.php, 2 trainersearch.php, and 3 gymsearch.php, and via the 'id' parameter in 4 paymentsearch.php. An unauthenticated remote attacker can exploit these issues to inje...

CVE-2025-67146

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in 1 membersearch.php, 2 trainersearch.php, and 3 gymsearch.php, and via the 'id' parameter in 4 paymentsearch.php. An unauthenticated remote attacker can exploit these issues to inje...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the searchsend parameter, which is dynamically invoked using the send method. An attacker can execute arbitrary commands on the server by supplying crafted input to this parameter. Remediation Upgrade spree ...

WordPress Search & Go theme <= 2.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Search & Go versions = 2.8...

Origin Validation Error

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Origin Validation Error in the REST server, accessible via the...

CVE-2025-67146

The AbhishekMali21 GYM-MANAGEMENT-SYSTEM version 1.0 is vulnerable to multiple SQL Injection flaws. These vulnerabilities originate from the unvalidated 'name' parameter in member_search.php, trainer_search.php, and gym_search.php, as well as the unvalidated 'id' parameter in payment_search.php. ...

GYM-MANAGEMENT-SYSTEM 安全漏洞

GYM-MANAGEMENT-SYSTEM is a gym management system by Abhishek S Personal Developer. A security vulnerability exists in GYM-MANAGEMENT-SYSTEM version 1.0, which stems from the unvalidated name parameter in membersearch.php, trainersearch.php, and gymsearch.php, and the id parameter in...

CVE-2025-67146

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in 1 membersearch.php, 2 trainersearch.php, and 3 gymsearch.php, and via the 'id' parameter in 4 paymentsearch.php. An unauthenticated remote attacker can exploit these issues to inje...

PT-2026-2301

Name of the Vulnerable Software and Affected Versions AbhishekMali21 GYM-MANAGEMENT-SYSTEM version 1.0 Description The application contains multiple SQL Injection flaws. These issues are present via the name parameter in the member search.php, trainer search.php, and gym search.php files, and via...

PT-2026-2347

Name of the Vulnerable Software and Affected Versions Hikvision Access Control Products affected versions not specified Description A stack overflow issue exists in the device Search and Discovery feature of Hikvision Access Control Products. An attacker on the same local area network LAN can cau...