298305 matches found
Exploit for CVE-2026-19660
CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...
Malicious code in @nagular/router (npm)
@nagular/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...
CVE-2026-80518 WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...
EUVD-2026-91919
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-97344 Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-97344 Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-92551 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppressbillingaddress Filename Parameter in all versions up to, and including, 4.17.4 due to insufficie...
FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection
FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...
PT-2026-104483
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...
PT-2026-104586
Name of the Vulnerable Software and Affected Versions Ultimate Member versions prior to 2.13.2 Description An authorization bypass exists due to a user-controlled key, which allows for privilege escalation. Recommendations Update to version 2.13.2 or later...
PT-2026-104511
Name of the Vulnerable Software and Affected Versions Strong Testimonials versions prior to 3.3.12 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a...
Linux Distros Unpatched Vulnerability : CVE-2026-104733
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN...
PT-2026-104590
Name of the Vulnerable Software and Affected Versions vincent-peugnet/wcms versions prior to 3.18.1 Description A stored cross-site scripting issue allows unauthenticated attackers to inject scripts through the login user field and the visitor comment website field. Scripts can be executed with...
CVE-2026-96270: Improper Neutralization of Input During Web Page Generation
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...
CVE-2026-104055
The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...
CVE-2026-104733
User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...
DEBIAN-CVE-2026-104733
User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...
CVE-2026-104733
User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...
UBUNTU-CVE-2026-104733
User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...
CVE-2026-104733 User Impersonation/Authorization Bypass in XMPP Server ejabberd
User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...