CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2024-44725

AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php...

CVE-2024-44724

AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsiteurl parameter at /admin/siteadd.php. This vulnerability allows attackers to execute arbitrary PHP code via injecting a crafted value...

CVE-2024-44724

The AutoCMS v5.4 Content Management System contains a PHP code injection vulnerability. The root cause is the improper handling of the txtsite_url parameter at the /admin/site_add.php API endpoint, which allows an attacker to execute arbitrary PHP code by injecting a crafted value. This could lea...

CVE-2024-44725

AutoCMS version 5.4 is vulnerable to a SQL injection vulnerability. The root cause is the lack of validation for externally entered SQL statements within the sidebar parameter at the /admin/robot.php endpoint. An attacker can exploit this to execute illegal SQL commands, potentially leading to th...

CVE-2024-44724

AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsiteurl parameter at /admin/siteadd.php. This vulnerability allows attackers to execute arbitrary PHP code via injecting a crafted value...

CVE-2024-44725

AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php...

CVE-2024-44724

AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsiteurl parameter at /admin/siteadd.php. This vulnerability allows attackers to execute arbitrary PHP code via injecting a crafted value...

CVE-2024-44725

AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php...

Cross site scripting

Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to execute arbitrary code via the video-js.swf...

CVE-2020-21486

SQL injection vulnerability in PHPOK v.5.4. allows a remote attacker to obtain sensitive information via the userlist function in framerwork/phpokcall.php file...

CVE-2021-35370

An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function...

Design/Logic Flaw

An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function...

CVE-2021-35370

An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function...

CVE-2021-35370: Improper Input Validation

An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function...

GSD-2023-1001387 usb: roles: fix of node refcount leak in usb_role_switch_is_parent()

usb: roles: fix of node refcount leak in usbroleswitchisparent This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001267 fs: ext4: initialize fsdata in pagecache_write()

fs: ext4: initialize fsdata in pagecachewrite This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001265 ext4: fix reserved cluster accounting in __es_remove_extent()

ext4: fix reserved cluster accounting in esremoveextent This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001072 usb: roles: fix of node refcount leak in usb_role_switch_is_parent()

usb: roles: fix of node refcount leak in usbroleswitchisparent This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000152 mm/khugepaged: take the right locks for page table retraction

mm/khugepaged: take the right locks for page table retraction This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.83 by commit...