24307 matches found
CVE-2026-61876
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages...
EUVD-2026-43235
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders...
CVE-2026-15494 AMTT Hotel Broadband Operation System switch_status.php sql injection
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switchstatus.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and...
EUVD-2026-43216
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switchstatus.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and...
CVE-2026-15494
AMTT Hotel Broadband Operation System 1.0 contains a SQL injection flaw in an unknown function of file manager/network/switch_status.php. Manipulating the argument ID remotely can lead to SQL injection. An exploit has been published and may be used; vendor contact occurred with no response. Docum...
CVE-2026-15511
creationtimestamp| type| source ---|---|--- 2026-07-12 10:25:44+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116906521019305139 2026-07-12 23:36:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqidsx7oaq2e 2026-07-12 23:51:52+00:00| seen|...
CVE-2026-15471
A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pcidssstatus.jsp. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Th...
CVE-2026-15471 Eleveo Call Recording Software pci_dss_status.jsp improper authorization
A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pcidssstatus.jsp. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Th...
CVE-2026-15471
Eleveo Call Recording Software 9.7.0 contains a vulnerability in an unknown portion of /callrec/pci_dss_status.jsp that allows improper authorization. The issue supports remote exploitation and the exploit has been made public. No remediation details are provided in the document. Vendor contact o...
EUVD-2026-43193
A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pcidssstatus.jsp. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Th...
CVE-2026-15480
creationtimestamp| type| source ---|---|--- 2026-07-11 15:38:28+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116902088383530926 2026-07-12 06:52:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqglom7dkg2w 2026-07-12 07:00:32+00:00| seen|...
Use After Free
Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...
CVE-2026-15484
creationtimestamp| type| source ---|---|--- 2026-07-11 12:30:42+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116901350103809605 2026-07-12 07:30:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/116905831499436002 2026-07-12 07:30:25+00:00| seen|...
CVE-2026-29519
creationtimestamp| type| source ---|---|--- 2026-07-11 10:26:40+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116900862378837802 2026-07-12 11:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqgzlgbsyo2r 2026-07-13 22:00:05+00:00| seen|...
CVE-2026-6801
creationtimestamp| type| source ---|---|--- 2026-07-11 07:35:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5nejffn2e 2026-07-11 08:02:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqe76hgzi22x...
CVE-2026-11901
The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the webhookprocesspaypalstandard IPN handler selecting its PayPal validation endpoint from the attacker-controlled $REQUEST'testipn...
CVE-2026-12738 WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-43151
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...