CVE-2026-12260

The NetBoard CRM demo platform is vulnerable to a SQL injection flaw in the ‘user-name’ POST parameter of the ‘/module/auth/recovery.php’ endpoint. The vulnerability allows for blind attacks using Boolean, error, time-based, and UNION techniques. Successful exploitation enables an attacker to ext...

EUVD-2026-94803

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

EUVD-2026-94798

In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches...

EUVD-2026-94792

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

CVE-2026-85488

Brocade ASCG versions prior to 3.5.0 are susceptible to a hardcoded credential exposure. A well-known Brocade default password is embedded within a script distributed to every customer. A local authenticated user with read access to the installation path can discover these credentials. If default...

fortigate-cve-2022-40684-tool

설명 이 도구는 노출된 CMDB API 엔드포인트를 호출하여 FortiGate 장치의 CVE-2022-40684 노출 여부를 식별하고 검증할 수 있도록 보안 전문가를 지원합니다. 관리 사용자 및 사용자 그룹 열거와 통제된 환경에서의 분석을 위한 선택적 구성 추출을 지원합니다. 기능 취약점 탐지 관리 사용자 열거 로컬 사용자 및 그룹 열거 선별적 구성 덤프 실험실용 안전 테스트 유틸리티 취약점 세부 정보 CVE: CVE-2022-40684 유형: 인증 우회 영향 제품: FortiGate / FortiOS 영향: 관리 API...

CVE-2026-94245

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

CVE-2026-94244

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

CVE-2026-94258

The SMS Alert WordPress plugin versions 3.6.4 through 4.0.0 contains a vulnerability where it fails to verify if an acting administrator has permission to manage specific users before returning their stored billing phone numbers. This flaw allows an administrator of one site on a multisite networ...

sudowp-crowdsignal-forms

SudoWP Crowdsignal Forms Это форк безопасности SudoWP оригинального плагина Crowdsignal Forms. !WARNING Уведомление о безопасности : Оригинальный плагин "Crowdsignal Forms" версии = 1.7.2 содержит критическую уязвимость Missing Authorization CVE-2025-69015 , позволяющую аутентифицированным...

CVE-2024-1086

CVE-2024-1086 汎用ローカル権限昇格 Proof-of-Concept エクスプロイト CVE-2024-1086 は、v5.14 から v6.6 までのほとんどの Linux カーネル（Debian、Ubuntu、KernelCTF を含む）で動作します。KernelCTF イメージでの成功率は 99.4% です。 https://github.com/Notselwyn/CVE-2024-1086/assets/68616630/a3d43951-94ab-4c09-a14b-07b81f89b3de ブログ記事 / 解説...

CVE-2026-87673

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A...

CVE-2026-44595

CVE-2026-44595 — Неавторизованное перечисление пользователей YAMCS через IAM API Краткое описание Конечные точки IAM API listUsers, getUser, listGroups, getGroup в yamcs-core не проверяют наличие обязательного разрешения SystemPrivilege.ControlAccess. Любой аутентифицированный пользователь — даже...

CVE-2026-87660

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...

EUVD-2026-94697

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...

CVE-2026-94575

A logic vulnerability exists in the Brocade Fabric OS web management framework in versions before 10.0.1 . This flaw allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation can lower the ...

SimpleHelp <= 5.5.7 - Arbitrary File Upload

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. This template is a...

Ray < 2.52.0 - Remote Code Execution

Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic rejecting Mozilla-prefixed headers can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable. i...

Klog Server <=2.41 - Unauthenticated Command Injection

Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The authenticate.php file uses the user HTTP POST parameter in a call to the shellexec PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...