Lucene search
+L

2008 matches found

EUVD
EUVD
added 2026/09/11 5:09 p.m.6 views

EUVD-2026-76159

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

6.1CVSS0.00268EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/11 11:24 a.m.6 views

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

7.5CVSS5.8AI score
SaveExploits0References4
NVD
NVD
added 2026/09/11 10:16 a.m.7 views

CVE-2026-17037

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS0.00304EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 9:27 a.m.8 views

EUVD-2026-76028

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS0.00304EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 7:37 a.m.10 views

EUVD-2026-76006

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same network can intercept a student's connection packet and replay it, thereby forging the appearance that the student remains connected...

5.3CVSS0.00106EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/11 7:37 a.m.19 views

CVE-2026-89179

WeenyGenius , a computer lab management system by Howyar Technologies , is affected by a Missing Support for Integrity Check vulnerability. An unauthenticated attacker on the same (adjacent) network can intercept a student's connection packet and replay it, forging the appearance that the student...

5.3CVSS0.00106EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/11 7:36 a.m.16 views

CVE-2026-89178

WeenyGenius , a computer lab management system by Howyar Technologies , suffers from an Origin Validation Error that allows unauthenticated attackers on the same network to spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection wit...

8.8CVSS0.00229EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/11 7:36 a.m.38 views

CVE-2026-89178 Howyar|WeenyGenius - Origin Validation Error

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

8.8CVSS0.00229EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 7:34 a.m.10 views

EUVD-2026-76002

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

6.9CVSS0.00319EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 7:27 a.m.12 views

EUVD-2026-76000

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

6.9CVSS0.00261EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/11 7:27 a.m.16 views

CVE-2026-89173

The Smart Video Intercom System developed by Kingdom Communication Associated is affected by a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses, allowing them to discover which accounts exist on...

6.9CVSS0.00261EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/11 7:27 a.m.35 views

CVE-2026-89173 Kingdom Communication Associated|Smart Video Intercom System - Sensitive Data Exposure

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

6.9CVSS0.00261EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 6:37 a.m.6 views

EUVD-2026-75976

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

7.5CVSS0.00297EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/11 4:17 a.m.8 views

CVE-2026-18561

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

7.5CVSS0.0033EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/11 3:39 a.m.7 views

EUVD-2026-75941

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

6.1CVSS0.00211EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/11 3:39 a.m.44 views

CVE-2026-18562 HUSKY <= 1.4.3 - Reflected Cross-Site Scripting

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wploadjs...

6.1CVSS0.00227EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/11 3:39 a.m.11 views

EUVD-2026-75935

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

7.2CVSS0.00241EPSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/11 3:27 a.m.16 views

CVE-2026-56158-.NET-Framework-RCE-PoC-Exploit

CVE-2026-56158 — .NET Framework Remote Code Execution RCE PoC Exploit Critical CVSS 9.8 — Deserialization of Untrusted Data CWE-502 in Microsoft .NET Framework & .NET Runtime Patched: July 14, 2026 | Attributed to: Positive Technologies PT-2026-60174 Table of Contents Overview Vulnerability Detai...

5.9AI score
SaveExploits1
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.12 views

PT-2026-90003

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

6.1CVSS0.00268EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.11 views

PT-2026-90496

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/delete entries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation ...

6.1CVSS0.00189EPSS
SaveExploits0References3
Rows per page
Query Builder