120001 matches found
Agentejo Cockpit <0.11.2 - NoSQL Injection
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller. id: CVE-2020-35847 info: name: Agentejo Cockpit 0.11.2 - NoSQL Injection author: dwisiswant0 severity: critical description: | Agentejo Cockpit before 0.11.2 allows NoS...
Adobe ColdFusion - Arbitrary File Read
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary...
ManageEngine ADManager Plus - Command Injection
Zoho ManageEngine ADManager Plus through 7180 allows for authenticated users to exploit command injection via Proxy settings. id: CVE-2023-29084 info: name: ManageEngine ADManager Plus - Command Injection author: rootxharsh,iamnoooob,pdresearch severity: high description: | Zoho ManageEngine...
Joomla! Core SQL Injection
A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. id: CVE-2015-7297 info: name: Joomla! Core SQL Injection author: princechaddha severity: high description: A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote...
Cacti <=1.2.22 - Remote Command Injection
Cacti through 1.2.22 is susceptible to remote command injection. There is insufficient authorization within the remote agent when handling HTTP requests with a custom Forwarded-For HTTP header. An attacker can send a specially crafted HTTP request to the affected instance and execute arbitrary OS...
Rails File Content Disclosure
Rails 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed. id: CVE-2019-5418 info: name: Rails File Content Disclosure...
CVE-2026-78466
This CVE is marked as a rejected reservation duplicate of CVE-2026-78278 , but connected documents provide concrete technical details. The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0.11 , caused by missing valida...
EUVD-2026-65298
The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...
CVE-2026-78467
CVE-2026-78467 is a reservation duplicate of CVE-2026-78272 and has been rejected by the CNA. The underlying vulnerability affects the Fluent Support Pro plugin for WordPress, specifically a missing capability check on a function in all versions up to and including 2.3.1 . This allows authenticat...
CVE-2026-78467
...
EUVD-2026-65302
The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...
VulnCheck KEV: CVE-2026-63520
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...
PT-2026-81905
Name of the Vulnerable Software and Affected Versions @better-auth/sso versions prior to 1.4.8 @better-auth/sso versions prior to 1.6.27 @better-auth/sso versions prior to 1.7.0-rc.5 Description Two domain-ownership flaws exist when the SSO plugin is active. If domain verification is disabled,...
CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...
CVE-2026-61419
Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
EUVD-2026-65086
Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-61419
Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-61419
Dell ThinOS 10 versions prior to 2605_10.2518 are affected by an Improper Access Control vulnerability. A low-privileged attacker with local access can exploit this flaw to gain unauthorized access , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH , ve...
CVE-2026-71933
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...