239097 matches found
CVE-2026-65959
In Vitess 24.0.2 and earlier, the /debug/vrlog endpoint in vrlog.go calls vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote attacker reaching the vttablet debug HTTP port can stream live VReplication SQL statements and bound application...
CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...
CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...
EUVD-2026-61106
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...
CVE-2026-49222
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...
WordPress KiviCare plugin < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability
Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability discovered by Mokksh Parekh in WordPress Plugin KiviCare versions 4.5.2...
CVE-2026-49223
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
CVE-2026-49224
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...
CVE-2026-49222
In Vvveb versions before 1.0.8.4, the admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id without verifying that product_question.product_id belongs to the current vendor's admin_id. A low-privileged vendor can read, approve, edit, or delete questions unde...
CVE-2026-49222
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...
CVE-2026-49222 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...
CVE-2026-49221
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.p...
CVE-2026-74015
Unauthenticated SQL Injection in Readabler 2.0.18 versions...
CVE-2026-73392
Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...
CVE-2026-73365
Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...
CVE-2026-73345
Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...
CVE-2026-73355
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...