PT-2026-79291

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

CVE-2026-77019

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77020 CodeAstro Apartment Visitor Management System password-recovery.php sql injection

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-77019 CodeAstro Apartment Visitor Management System forgotpw.php sql injection

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

EUVD-2026-63421

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77019

CodeAstro Apartment Visitor Management System 1.0 has a SQL injection in /apartment-visitor/forgotpw.php via the secode argument, exploitable remotely without authentication (CVSS 7.5 HIGH). A proof-of-concept exploit is publicly disclosed; no patch version is provided. Exploitation details are n...

PT-2026-79056

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

PT-2026-79068

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-14287

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

CVE-2026-66429

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66430

CVE-2026-66430 describes an SQL Injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions

CVE-2026-66430 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

EUVD-2026-57863

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

EUVD-2026-57862

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66429

The CVE concerns WordPress Plugin Visitor Traffic Real Time Statistics Pro (versions up to 11.10) with an unauthenticated Cross-Site Scripting (XSS) vulnerability. The affected component is the plugin’s web-facing handling that allows injection of script by an attacker without authentication; imp...

CVE-2026-66429 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66429

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-57858 Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...