solutions

Exploitmatic solutions !License: Apache 2.0https://img.sh...

Diary Management System 1.0 - Cross-Site Scripting

Diary Management System 1.0 contains a cross-site scripting vulnerability via the Name parameter in search-result.php. id: CVE-2022-29004 info: name: Diary Management System 1.0 - Cross-Site Scripting author: TenBird severity: medium description: | Diary Management System 1.0 contains a cross-sit...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

CVE-2026-6484

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-6484

CVE-2026-6484 concerns UEFI firmware where lack of verified boot for certain FV enables arbitrary code execution. The available data indicates a local attack vector with high privileges required and high impact on confidentiality, integrity, and availability (per CVSS 3.1 vector: AV:L/AC:L/PR:H/U...

CVE-2026-6484

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-6484 Lack of verified boot to certain FV may cause arbitrary code execution

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

EUVD-2026-57052

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

PT-2026-70961

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-17021 Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...

CVE-2026-16041

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...

CVE-2026-16041

The CVE-2026-16041 entry concerns the MStore API WordPress plugin prior to version 4.21.0. The REST endpoint used for creating product reviews lacks authorization and purchase-ownership checks, allowing an unauthenticated attacker to submit WooCommerce product reviews with arbitrary reviewer name...

CVE-2026-70490

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...

GHSA-5GPJ-VJ23-VHHV Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

CVE-2026-70490

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...

CVE-2026-0392

eParakstītājs 3.0 for Windows prior to 1.10.0 is vulnerable: its auto-update uses an unauthenticated/integrity-free channel. The client fetches an XML update descriptor over TLS while accepting any certificate, with no verification of the descriptor’s digital signature, no Authenticode/signature ...

CVE-2026-0392 eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor XML over TLS but accepts any TLS certificate a permissive TrustManager and ...

CVE-2026-15206

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

CVE-2026-15206

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...