174820 matches found
CVE-2026-41920 Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue...
CVE-2026-35226 Out-of-bounds Write in CODESYS PROFINET Controller
An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime...
CVE-2026-18197
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Link Library allows Cross-Site Scripting XSS. This issue affects Link Library: before 7.9.4...
CVE-2026-18192 Vacron｜IP Camera - Arbitrary File Read
VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...
CVE-2026-18191 Vacron｜IP Camera - Hidden Functionality
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device...
CVE-2026-63242 Business logic vulnerability
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
CVE-2026-63241 Insecure direct object reference vulnerability
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...
CVE-2026-63240 Information disclosure vulnerability
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...
CVE-2026-63239 Hard-coded AWS IAM credentials vulnerability
A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...
CVE-2026-63238 Authentication bypass vulnerability
An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...
CVE-2026-63237 TOTP two-factor authentication bypass vulnerability
A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...
CVE-2026-63236 Improper access control vulnerability
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint...
CVE-2026-63235 Improper access control vulnerability
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service...
CVE-2026-63234 SQL injection and unsafe deserialisation vulnerability
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63233 SQL injection and unsafe deserialisation vulnerability
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63232 SQL injection and unsafe deserialisation vulnerability
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63231 Post-authentication SQL injection vulnerability
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...
CVE-2026-63230 Pre-authentication error-based SQL injection vulnerability
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...
CVE-2026-63229 Pre-authentication blind SQL injection vulnerability
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...
CVE-2026-63228 Unrestricted image upload vulnerability
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server...
CVE-2026-63227 Unrestricted SCORM file upload vulnerability
An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...
CVE-2026-14234 WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...
CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...
CVE-2026-14224 Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...
CVE-2026-11974 Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download
The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...
CVE-2026-13423 Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2026-13692 PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering
The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...
CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...
CVE-2026-13690 UsersWP < 1.2.67 - Two-Factor Authentication Bypass
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...
CVE-2026-11351 ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published e.g. draft, pending or private WooCommerce products...
CVE-2026-18072 Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the arveucinit function — registered on WordPress's init hook at priority 1 so...
CVE-2026-5626 Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export
The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getalldata function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export a...
CVE-2026-15344 WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-12476 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edddoajaximportfileupload function , which only checks the client-supplied $FILES'edd-import-file''type' Content-Ty...
CVE-2026-17161 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-17162 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17166 Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-12939 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...
CVE-2026-12144 Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...
CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...
CVE-2026-15735 Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-67404
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...
CVE-2025-67407
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatestudent.php via parameters fname and studentclass...
CVE-2025-65340
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php...
CVE-2025-67403
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updateclass.php via the parameter classname...
CVE-2025-67405
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...
CVE-2025-67406
https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code remote. The component is: control/activatecase.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activatecase.php in parameter id...
CVE-2025-67408
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /saveuser.php via the parameter status...
CVE-2026-50782
Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/spmanagergetUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...