CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL Injection in Online Shopping System Advanced Summary A critical SQL Injection vulnerability was discovered in the Online Shopping System Advanced project by PuneethReddyHC. The flaw resides in action.php, which fails to properly sanitize user input from the...

CVE-2022-28078

CVE-2022-28077 Home Owners Collection Management System 1.0 - Reflected XSS Exploit Title: Home Owners Collection Management System 1.0 - Reflected XSS Date: 2022-05-06 CVE: CVE-2022-28078 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2019-12889

CVE-2019-12889 Summary An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon screen can escalate their privileges to NT AUTHORITY\System. An attacker would need local access to the machine for a successful exploi...

EUVD-2026-100714

CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended...

ROS-20261014-73-0057

The vulnerability of the vcnv40decmsg function in the drivers/gpu/drm/amd/amdgpu/vcnv40.c driver for AMD GPU cores in Linux’s Direct Rendering Infrastructure DRI kernel relates to buffer overflow attacks. Exploiting this vulnerability can allow attackers to access protected information or cause...

PT-2026-114145

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive process irp create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with...

PT-2026-113665

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

PT-2026-114074

Name of the Vulnerable Software and Affected Versions MyReport Updater versions prior to 2.1.2 Description An unauthenticated gRPC service is exposed on TCP port 9095, allowing remote attackers to redirect the SYSTEM updater. This is achieved by invoking the UpdateConfigReferent method. Attackers...

PT-2026-113700

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove at job without validating it. Schedule::At::remove substitutes the supplied job ID into an at...

PT-2026-113640

Name of the Vulnerable Software and Affected Versions SiteGuard Server Edition versions 2.20 through 8.00 Update4 Description An OS command injection flaw exists in the statistics feature, which is enabled by default. This issue allows an attacker with local access and a low-privileged account to...

CVE-2026-50215

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...

EUVD-2026-100805

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...

PT-2026-113726

A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-8921-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8921-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-8919-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8919-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-8920-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8920-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20764)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system setup, resulting in remote...

PT-2026-113649

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6 HDRINCL socket to...

PT-2026-113642

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...

Linux Distros Unpatched Vulnerability : CVE-2026-107615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary...