Updated the bubble-detect.yaml file to improve clarity and specificity in the description and tags, and modified matchers and extractors for better detection.
CVE-2026-8181 details an authentication bypass vulnerability in the WordPress Burst Statistics plugin, allowing unauthenticated attackers to impersonate administrators. The YAML file includes information about the vulnerability, its impact, remediation steps, and HTTP request flow for exploitation.
Template id, name, description, and references all identify CVE-2024-38856,
but classification.cve-id incorrectly read CVE-2024-32113 (a related OFBiz
vulnerability with the same root cause). Aligned the field to match.
This YAML file describes a critical unauthenticated SQL injection vulnerability in YesWiki versions prior to 4.6.4, detailing its impact, remediation steps, and relevant references.
- Merge consecutive body word blocks into one block with condition: and
- Templates with OR secondary signals merged into single condition: or block
- Header-part matchers (emoncms, microsys-promotic) left as separate blocks
- All 41 templates validated; snip 40/41 confirmed >=2 live hosts
- Separate word matcher blocks with explicit part: body
- Add host-redirects: true + max-redirects: 2 to all requests
- Add verified: true, vendor:, product: metadata fields
- Title-first primary matchers across all 41 templates
- Product-specific secondary OR blocks; snip header matchers where appropriate
- Validated all 41 templates against live Shodan hosts (40/41 >= 2 hosts)
Updated the description of the Kong API Gateway's internal /status endpoint to clarify its accessibility and the sensitive information it exposes. Adjusted the maximum request limit and refined matchers and extractors for improved accuracy.
Enumerates the users registered in the Gitea web application, a self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD.
Two contains() expressions opened with " and closed with '. The
Knetic/govaluate parser previously tolerated this silently; once
projectdiscovery/dsl switched to projectdiscovery/govaluate
(projectdiscovery/dsl#305, released in v0.8.18) the stricter
tokenizer rejects them with 'Unclosed string literal' and the
template is dropped at compile time. Normalize the quoting to
single-quoted strings; matched substrings are unchanged.
- LangSmith: LangChain debugging and monitoring platform
- Chainlit: Production-ready conversational AI framework
- Botpress: Chatbot and virtual assistant platform
All templates verified against live Shodan targets
Added CVE-2026-42569 entry detailing a critical authorization bypass in phpVMS versions < 7.0.6. Includes information on impact, remediation, and references.
Adds a nuclei template for detecting unauthenticated directory listing via the /list_personalities category parameter in LoLLMS WebUI.
The template first confirms the target is LoLLMS WebUI, then compares baseline and traversal responses to reduce false positives.
The regexes for the `Content-Type` matchers were anchored with ^, which only matches when `Content-Type` is the first header in the response. Dropping the anchor so the match is position-independent, consistent with the other checks in this template.
Renamed id in http/exposed-panels/fortinet/fortisandbox-panel.yaml from
`fortisandbox-panel` to `fortinet-fortisandbox-panel` to avoid conflict with
http/exposed-panels/fortisandbox-panel.yaml which uses the same id.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
Supabase Studio is the admin dashboard shipped with Supabase, the
popular open-source Firebase alternative. Self-hosted Studio
defaults to TCP 3000 in the supabase/postgres-meta stack and
historically has shipped with no auth — exposed instances grant
browser-driven full DB read/write access.
No existing supabase template in the repo.
Linkwarden (linkwarden.app) is a popular self-hosted bookmark and
link-archiving manager. Default Docker port 3000.
No existing linkwarden template in the repo.
Mealie (mealie.io) is a popular self-hosted recipe manager and
meal-planner. Vue/Nuxt frontend + FastAPI backend, often run in
homelab Docker stacks on TCP 9000 or 9925.
No existing mealie template in the repo.
ZITADEL is a popular open-source IAM platform — an Auth0/Keycloak
alternative providing OIDC, OAuth 2.0, SAML and machine-user
identity. Exposed self-hosted instances reveal organization/project
layout via unauthenticated discovery + login endpoints and provide
a starting point for credential/token attacks.
No existing zitadel template in the repo.
Paperless-ngx is a hugely popular self-hosted document-management
platform. Default Docker port 8000. Exposed instances may reveal
personal/business documents and the upload endpoint.
No existing paperless-ngx template in the repo.
Mage AI (mage.ai) is a popular open-source data pipeline + orchestration
platform with a notebook-style UI. Default port 6789. Has historically
shipped without auth. Exposed instances may reveal pipeline source,
secrets, and provide a code-execution path via custom blocks.
No existing mage-ai / mageai template in the repo.
Outline (getoutline.com / github.com/outline/outline) is a popular
open-source team knowledge base, often self-hosted as a Notion
alternative. Exposed instances may reveal team documents and provide
a login-enumeration path if SSO is misconfigured.
No existing outline template in the repo.
vLLM is a high-throughput LLM serving engine that exposes an
OpenAI-compatible HTTP API on TCP 8000 by default with no auth
unless --api-key is set. Exposed instances let any caller enumerate
loaded models and submit /v1/chat/completions requests, consuming
GPU and incurring cost.
Detection: /version returns vLLM version; /v1/models returns OpenAI-
shape JSON with owned_by:vllm. No existing vllm template in the repo.
LocalStack is a local AWS emulator widely used in development and CI.
Default port 4566. Exposed instances on non-loopback interfaces give
attackers a fully-functional fake AWS account (S3, SQS, IAM,
SecretsManager, Lambda execution).
Detection: /_localstack/health returns JSON with services map +
edition/version fields. No existing localstack template in the repo.
Airbyte (airbyte.com / github.com/airbytehq/airbyte) is a popular
open-source data integration platform. Self-hosted instances expose
an admin UI and a REST/GraphQL API at /api/v1/ that — when reachable
without authentication — leak source/destination configurations
including credentials.
Detection signatures:
- title 'Airbyte'
- /api/v1/health returning {"available":true}
No existing airbyte template in the repo.
Typesense (typesense.org) is a popular open-source typo-tolerant
search engine, often self-hosted on TCP 8108. It exposes an
unauthenticated /health endpoint that returns {"ok":true} and emits
distinctive x-typesense-* response headers. Exposed instances may
reveal collection schemas and provide an attack surface if the
api-key is also discoverable.
No existing typesense template in the repo.
Windmill (windmill.dev / github.com/windmill-labs/windmill) is a
popular open-source developer platform for workflows, scripts and
internal apps. Exposed self-hosted instances may reveal scripts,
secrets, and connected resources, and provide a path to authenticated
script execution.
Detection signatures:
- title contains 'Windmill'
- 'windmill_labs' string in body
- /api/version returns a vX.Y.Z string
No existing windmill template in the repo.
Langfuse is a popular open-source LLM observability + evals platform
(github.com/langfuse/langfuse, langfuse.com). Exposed self-hosted
instances may reveal LLM prompts, traces, evaluations, and
connected API keys.
Detection signatures:
- title contains 'Langfuse'
- x-langfuse-* response header
- /api/public/health returning {"status":"OK"} with version field
No existing langfuse template in the repo.
Detects an Apache Casbin MCP Gateway server, a lightweight gateway service that instantly transforms existing MCP Servers and APIs into MCP servers with zero code changes.
Updated the Apache Tomcat Manager default login template with refined descriptions, modified max-request limit, and adjusted username and password payloads for better security testing.
Companion to contrastapi-domain-recon.yaml (#15832).
Hits /v1/ip/{ip} and extracts ASN, country, PTR, open ports,
hostnames, cloud provider attribution, Tor exit status, risk_score
(0-100) with coarse severity_label (low/medium/high/critical), and
the per-IP CVE list (cve_id + severity each).
Single API call, no key required (100 req/hr keyless).
ChromaDB without CHROMA_SERVER_AUTHN_PROVIDER configured (the default
on `chroma run` and the stock Docker image) exposes its collections
API to the public:
- /api/v1/collections (Chroma <= 0.5.x)
- /api/v2/tenants/default_tenant/databases/default_database/collections (Chroma >= 0.5.5)
Both return JSON inventories of every collection along with collection
IDs and metadata, enabling attackers to enumerate the underlying RAG
corpus, fetch embedded documents from /api/v1/collections/{id}/get,
and write adversarial vectors via /add to poison downstream LLM
retrieval.
Existing repo coverage:
- http/misconfiguration/installer/chromadb-installer.yaml only matches
the /setup admin page; it does not check for unauth API access.
- http/technologies/chromadb-detect.yaml only fingerprints presence.
This template fills the gap by probing both the v1 and v2 paths,
matching on the JSON shape of a collections inventory, and extracting
collection names so the operator sees the blast radius from scan
output.
Severity high (CVSS 9.4) — vector DBs in RAG pipelines commonly hold
embedded copies of enterprise corpora.
LiteLLM proxy without `general_settings.master_key` exposes the entire
upstream model catalog and routing config to anonymous visitors via
/model/info. The shape includes per-model litellm_params (provider
credentials, base URLs, deployment IDs for Azure/Bedrock/etc.) and
model_info metadata — directly identifying which OpenAI / Anthropic /
Azure / Bedrock / local-LLM endpoints the proxy is fronting.
Same misconfiguration usually leaves /chat/completions and /embeddings
accessible too, enabling cost-amplification attacks against the
upstream accounts.
Probe: GET /model/info — LiteLLM-specific path, JSON shape with
"litellm_params" + "model_info" makes the matcher unambiguous and
keeps it from firing on generic OpenAI-compat servers (vLLM, ollama
OpenAI mode, llama.cpp server) which expose /v1/models in the same
shape but lack the LiteLLM routing surface.
Severity medium (CVSS 6.5) — confidentiality + low-availability impact
on upstream accounts.
Tomcat 7+ enables LockOutRealm by default — five failed attempts against
a single user lock that user out for five minutes. The previous payload
ordering exhausted lockout long before reaching the most-common
credential pairs. The reporter (#15382) confirmed `admin:manager` was
missed because `manager` was the 13th password tried for `admin`,
hitting lockout after the 5th attempt.
Reordered both payload lists so the highest-probability defaults run
first:
- Usernames: tomcat, admin, manager, root, role1 — covers the standard
Tomcat install + Tomcat-Users sample roles before the long tail of
appliance-specific accounts (QCC, cxsdk, ovwebusr, j2deployer).
- Passwords: tomcat, admin, manager, password, s3cret — the actual
defaults that ship with Tomcat installers and lab images.
With this ordering, the first 5 attempts for any user cover the top 5
real-world credential pairs, so LockOutRealm-protected systems still
yield positive detections.
Added a metadata `note:` documenting the lockout interaction.
Closes#15382
The matcher required `Server: oast` in the response header, which only
matches the default interactsh deployment naming (oast.fun, oast.pro,
etc.). Users running custom interactsh servers under any other hostname
hit a guaranteed false negative — the SSRF still fires, but detection
silently misses it.
`X-Interactsh-Version` is the universal interactsh signal — it's emitted
by every interactsh server regardless of hostname configuration. Dropping
the redundant `Server:` literal makes the template work with any
interactsh deployment.
Closes#12074
clear-site-data is a logout-flow header (per W3C Clear-Site-Data spec, sent
on /logout / /signout responses to evict session data). It has no business
appearing on a base URL and was triggering false positives on every site
where the header is correctly scoped to logout endpoints.
Closes#12008
CVE-2026-23486 details an information leak in Blinko <= 1.8.3, allowing remote attackers to access sensitive user data via a public endpoint. The remediation suggests updating to version 1.8.4 or later.
RestroPress plugin versions 3.0.0 to 3.1.9.2 are vulnerable to an authentication bypass due to JWT forgery, allowing unauthenticated users to authenticate as any user, including admins. Update to the latest version beyond 3.1.9.2 to remediate this issue.
Updated the Perforce server detection template with improved descriptions, metadata, and tag adjustments. Removed unnecessary hex byte decoding comments.
Updated the Perforce unauthenticated remote depot access template to clarify the description and improve metadata. Adjusted fields for better accuracy and removed unnecessary comments.
Updated the Perforce user enumeration template to clarify the description and improve metadata. Adjusted remediation instructions and modified the tags and product information.
Updated the Perforce server information disclosure template to improve clarity and accuracy. Adjusted fields and descriptions related to server information exposure.
- move laravel-ignition-log-viewer to http/exposures/logs/ (information disclosure, not vuln primitive)
- sanctum: tighten matcher to require reflected Access-Control-Allow-Origin + Access-Control-Allow-Credentials headers (instead of generic body match)
- split debugbar/clockwork into separate templates (laravel-debugbar-exposure.yaml + laravel-clockwork-exposure.yaml) for accurate fingerprinting
The template was matching any WordPress site returning a 200 with
'lostpasswordform' in the body or a 302 with reauth/login in the
redirect, without confirming the WPS Hide Login plugin actually
disclosed the hidden login URL.
Changes:
- http(2): Added regex matcher to verify a form action containing
'lostpassword' exists in a non-wp-login.php URL (the actual
vulnerability indicator)
- http(3): Added regex matcher to verify the Location header
contains 'lostpassword' (confirming URL disclosure via redirect)
- http(3): Added extractor to capture the disclosed redirect URL
Without the plugin active, WordPress returns the standard
wp-login.php URL which is filtered out by the existing
'!contains(body, wp-login.php)' check. The new regex matchers
add a second layer of verification ensuring the extracted URL
is actually a hidden login page.
Fixes#15871
The current template matches any page containing '/sentry/' and 'Login'
in the body, which can match non-Sentry login pages. Adding a check
that the HTML <title> contains 'sentry' prevents these false positives.
Made-with: Cursor
The previous template matched on len(data)==0 which triggers on ANY host
where port 427 is closed or filtered, causing massive false positives.
Fix adds a pre-check (step 1) that verifies OpenSLP is actually running
and responding before sending the crash payload. The three-step flow:
1. Send normal SLP query — must get a response (internal matcher)
2. Send heap overflow payload to crash OpenSLP
3. Re-query — if len(data)==0 now, the service crashed (vulnerable)
This eliminates false positives from hosts that simply don't run OpenSLP.
Updated severity level from low to medium and adjusted max-request limit from 3 to 1. Enhanced matcher to include 'log_position' in the API response validation.
CVE-2026-28409 details added, highlighting a critical remote code execution vulnerability in WeGIA versions <= 3.6.4. The YAML file includes information on impact, remediation, and example HTTP requests.
- Match on <title>FortiSandbox and HTTP 200 status
- Target path: /ng/login?returnUrl=%2F
- Shodan query: http.title:"FortiSandbox"
Co-authored-by: Copilot <[email protected]>
Detects PTZOptics camera devices exposed via mDNS on port 5353.
PTZOptics cameras broadcast service advertisements including SSH, SFTP, and NDI streaming.
Template verified against live targets showing characteristic NDI + SSH service combination.
Detected Microsoft Office macro restrictions were not configured, increasing the risk of macro-based malware delivery through Office documents.
impact:|
Unrestricted macros allow attackers to deliver malware through Office documents, a common initial access vector.
remediation:|
Configure Group Policy to disable macros: User Configuration > Administrative Templates > Microsoft Office > Security > VBA Macro Notification Settings > Disable all without notification (VBAWarnings = 4).
Detected Windows automatic updates were found disabled, leaving the system vulnerable to unpatched security flaws.
impact:|
Systems without automatic updates will miss critical security patches, increasing exposure to known vulnerabilities and exploits.
remediation:|
Enable automatic updates via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates > set to Auto download and schedule install.
Detects weak Windows service binary permissions that could allow non-administrative users to modify the service binary, potentially leading to local privilege escalation.
Write-Output "$identity can $rights the service binary at $binaryPath for service '$($service.Name)' running as '$($service.StartName)' on '$($service.StartMode)' mode"
{"ID":"CVE-2017-5982","Info":{"Name":"Kodi 17.1 - Local File Inclusion","Severity":"high","Description":"Kodi 17.1 is vulnerable to local file inclusion vulnerabilities because of insufficient validation of user input.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-5982.yaml"}
{"ID":"CVE-2017-5983","Info":{"Name":"JIRA Workflow Designer Plugin in Atlassian JIRA Server \u003e 6.3.0 - Remote Code Execution (XXE)","Severity":"critical","Description":"The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-5983.yaml"}
{"ID":"CVE-2017-6090","Info":{"Name":"PhpColl 2.5.1 Arbitrary File Upload","Severity":"high","Description":"PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/ via clients/editclient.php.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2017/CVE-2017-6090.yaml"}
{"ID":"CVE-2017-6478","Info":{"Name":"MaNGOSWebV4 \u003c 4.0.8 - Cross-Site Scripting","Severity":"medium","Description":"paintballrefjosh/MaNGOSWebV4 \u003c 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php (step parameter), letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-6478.yaml"}
{"ID":"CVE-2017-7269","Info":{"Name":"Windows Server 2003 \u0026 IIS 6.0 - Remote Code Execution","Severity":"critical","Description":"Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in the ScStoragePathFromUrl function in the WebDAV service that could allow remote attackers to execute arbitrary code via a long header beginning with \"If \u003chttp://\" in a PROPFIND request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-7269.yaml"}
{"ID":"CVE-2017-7391","Info":{"Name":"Magmi 0.7.22 - Cross-Site Scripting","Severity":"medium","Description":"Magmi 0.7.22 contains a cross-site scripting vulnerability due to insufficient filtration of user-supplied data (prefix) passed to the magmi-git-master/magmi/web/ajax_gettime.php URL.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-7391.yaml"}
{"ID":"CVE-2017-7615","Info":{"Name":"MantisBT \u003c=2.30 - Arbitrary Password Reset/Admin Access","Severity":"high","Description":"MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2017/CVE-2017-7615.yaml"}
@@ -862,6 +863,7 @@
{"ID":"CVE-2019-25141","Info":{"Name":"Easy WP SMTP \u003c= 1.3.9 - Missing Authorization to Arbitrary Options Update","Severity":"critical","Description":"The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-25141.yaml"}
{"ID":"CVE-2019-25152","Info":{"Name":"Abandoned Cart Lite for WooCommerce \u003c 5.2.0 - Cross-Site Scripting","Severity":"high","Description":"The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2019/CVE-2019-25152.yaml"}
{"ID":"CVE-2019-25213","Info":{"Name":"WordPress Advanced Access Manager - Path Traversal","Severity":"critical","Description":"The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-25213.yaml"}
{"ID":"CVE-2019-25246","Info":{"Name":"BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure","Severity":"high","Description":"Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2019/CVE-2019-25246.yaml"}
{"ID":"CVE-2019-2578","Info":{"Name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control","Severity":"high","Description":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2019/CVE-2019-2578.yaml"}
{"ID":"CVE-2019-2579","Info":{"Name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection","Severity":"medium","Description":"The Oracle WebCenter Sites component of Oracle Fusion Middleware 12.2.1.3.0 is susceptible to SQL injection via an easily exploitable vulnerability that allows low privileged attackers with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2019/CVE-2019-2579.yaml"}
{"ID":"CVE-2019-2588","Info":{"Name":"Oracle Business Intelligence - Path Traversal","Severity":"medium","Description":"Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).\n","Classification":{"CVSSScore":"4.9"}},"file_path":"http/cves/2019/CVE-2019-2588.yaml"}
{"ID":"CVE-2020-10220","Info":{"Name":"rConfig 3.9 - SQL Injection","Severity":"critical","Description":"An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10220.yaml"}
{"ID":"CVE-2020-10257","Info":{"Name":"ThemeREX Addons - Remote Code Execution","Severity":"critical","Description":"ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trx_addons/v2/get/sc_layout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter, letting attackers execute arbitrary PHP functions, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10257.yaml"}
{"ID":"CVE-2020-10532","Info":{"Name":"WatchGuard Fireware AD Helper Component - Credentials Disclosure","Severity":"critical","Description":"WatchGuard Fireware Threat Detection and Response (TDR) service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2020/CVE-2020-10532.yaml"}
{"ID":"CVE-2020-10546","Info":{"Name":"rConfig 3.9.4 - SQL Injection","Severity":"critical","Description":"rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10546.yaml"}
{"ID":"CVE-2020-10547","Info":{"Name":"rConfig 3.9.4 - SQL Injection","Severity":"critical","Description":"rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10547.yaml"}
{"ID":"CVE-2020-10548","Info":{"Name":"rConfig 3.9.4 - SQL Injection","Severity":"critical","Description":"rConfig 3.9.4 and previous versions have unauthenticated devices.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10548.yaml"}
@@ -1403,6 +1406,7 @@
{"ID":"CVE-2021-24891","Info":{"Name":"WordPress Elementor Website Builder \u003c3.1.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Elementor Website Builder plugin before 3.1.4 contains a DOM cross-site scripting vulnerability. It does not sanitize or escape user input appended to the DOM via a malicious hash.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24891.yaml"}
{"ID":"CVE-2021-24910","Info":{"Name":"WordPress Transposh Translation \u003c1.0.8 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Transposh Translation plugin before 1.0.8 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24910.yaml"}
{"ID":"CVE-2021-24915","Info":{"Name":"Contest Gallery \u003c 13.1.0.6 - SQL injection","Severity":"critical","Description":"The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-24915.yaml"}
{"ID":"CVE-2021-24916","Info":{"Name":"WordPress Qubely \u003c 1.8.6 - Unauthenticated Email Sending","Severity":"high","Description":"Qubely WordPress plugin \u003c 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubely_send_form_data AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-24916.yaml"}
{"ID":"CVE-2021-24917","Info":{"Name":"WordPress WPS Hide Login \u003c1.9.1 - Information Disclosure","Severity":"high","Description":"WordPress WPS Hide Login plugin before 1.9.1 is susceptible to incorrect authorization. An attacker can obtain the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. This reveals the secret login location.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-24917.yaml"}
{"ID":"CVE-2021-24926","Info":{"Name":"WordPress Domain Check \u003c1.0.17 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Domain Check plugin before 1.0.17 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the domain parameter before outputting it back in the page.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24926.yaml"}
{"ID":"CVE-2021-24931","Info":{"Name":"WordPress Secure Copy Content Protection and Content Locking \u003c2.8.2 - SQL Injection","Severity":"critical","Description":"WordPress Secure Copy Content Protection and Content Locking plugin before 2.8.2 contains a SQL injection vulnerability. The plugin does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action, available to both unauthenticated and authenticated users, before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-24931.yaml"}
@@ -1467,6 +1471,7 @@
{"ID":"CVE-2021-26723","Info":{"Name":"Jenzabar 9.2x-9.2.2 - Cross-Site Scripting","Severity":"medium","Description":"Jenzabar 9.2.x through 9.2.2 contains a cross-site scripting vulnerability. It allows /ics?tool=search\u0026query.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-26723.yaml"}
{"ID":"CVE-2021-26812","Info":{"Name":"Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting","Severity":"medium","Description":"Moodle Jitsi Meet 2.7 through 2.8.3 plugin contains a cross-site scripting vulnerability via the \"sessionpriv.php\" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject JavaScript code to be run by the application.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-26812.yaml"}
{"ID":"CVE-2021-26855","Info":{"Name":"Microsoft Exchange Server SSRF Vulnerability","Severity":"critical","Description":"This vulnerability is part of an attack chain that could allow remote code execution on Microsoft Exchange Server. The initial attack requires the ability to make an untrusted connection to Exchange server port 443. Other portions of the chain can be triggered if an attacker already has access or can convince an administrator to open a malicious file. Be aware his CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, and CVE-2021-27078.","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2021/CVE-2021-26855.yaml"}
{"ID":"CVE-2021-26947","Info":{"Name":"Odoo \u003c= 15.0 - Cross-Site Scripting","Severity":"medium","Description":"A cross-site scripting (XSS) vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of the user's browser session.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-26947.yaml"}
{"ID":"CVE-2021-27124","Info":{"Name":"Doctor Appointment System 1.0 - SQL Injection","Severity":"medium","Description":"SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-27124.yaml"}
{"ID":"CVE-2021-27132","Info":{"Name":"Sercomm VD625 Smart Modems - CRLF Injection","Severity":"critical","Description":"Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT_2.1.0 are vulnerable to Carriage Return Line Feed (CRLF) injection via the Content-Disposition header.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-27132.yaml"}
{"ID":"CVE-2021-27309","Info":{"Name":"Clansphere CMS 2011.4 - Cross-Site Scripting","Severity":"medium","Description":"Clansphere CMS 2011.4 contains an unauthenticated reflected cross-site scripting vulnerability via the \"module\" parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-27309.yaml"}
@@ -1538,6 +1543,7 @@
{"ID":"CVE-2021-3129","Info":{"Name":"Laravel with Ignition \u003c= v8.4.2 Debug Mode - Remote Code Execution","Severity":"critical","Description":"Laravel version 8.4.2 and before with Ignition before 2.5.2 allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-3129.yaml"}
{"ID":"CVE-2021-31316","Info":{"Name":"CentOS Web Panel - SQL Injection","Severity":"critical","Description":"The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-31316.yaml"}
{"ID":"CVE-2021-31324","Info":{"Name":"CentOS Web Panel - OS Command Injection","Severity":"critical","Description":"The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-31324.yaml"}
{"ID":"CVE-2021-3152","Info":{"Name":"Home Assistant HACS - Local File Inclusion","Severity":"high","Description":"Home Assistant before 2021.1.3 lacks a protection layer against directory-traversal attacks in custom integrations, letting attackers access arbitrary files, exploit requires attacker to deploy malicious custom integration.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-3152.yaml"}
{"ID":"CVE-2021-31537","Info":{"Name":"SIS Informatik REWE GO SP17 \u003c7.7 - Cross-Site Scripting","Severity":"medium","Description":"SIS Informatik REWE GO SP17 before 7.7 contains a cross-site scripting vulnerability via rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-31537.yaml"}
{"ID":"CVE-2021-31581","Info":{"Name":"Akkadian Provisioning Manager - Information Disclosure","Severity":"medium","Description":"Akkadian Provisioning Manager is susceptible to information disclosure. The restricted shell provided can be escaped by abusing the Edit MySQL Configuration command. This command launches a standard VI editor interface which can then be escaped.","Classification":{"CVSSScore":"4.4"}},"file_path":"http/cves/2021/CVE-2021-31581.yaml"}
{"ID":"CVE-2021-31589","Info":{"Name":"BeyondTrust Secure Remote Access Base \u003c=6.0.1 - Cross-Site Scripting","Severity":"medium","Description":"BeyondTrust Secure Remote Access Base through 6.0.1 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-31589.yaml"}
@@ -1749,6 +1755,7 @@
{"ID":"CVE-2021-44528","Info":{"Name":"Open Redirect in Host Authorization Middleware","Severity":"medium","Description":"Specially crafted \"X-Forwarded-Host\" headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-44528.yaml"}
{"ID":"CVE-2021-44529","Info":{"Name":"Ivanti EPM Cloud Services Appliance Code Injection","Severity":"critical","Description":"Ivanti EPM Cloud Services Appliance (CSA) before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44529.yaml"}
{"ID":"CVE-2021-4462","Info":{"Name":"Employee Records System 1.0 - Unauthenticated File Upload RCE","Severity":"critical","Description":"Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4462.yaml"}
{"ID":"CVE-2021-4463","Info":{"Name":"Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download","Severity":"high","Description":"Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-4463.yaml"}
{"ID":"CVE-2021-44848","Info":{"Name":"Thinfinity VirtualUI User Enumeration","Severity":"medium","Description":"Thinfinity VirtualUI (before v3.0), /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users (Administrator, Guest, etc.)","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-44848.yaml"}
{"ID":"CVE-2021-44910","Info":{"Name":"SpringBlade - Information Leakage","Severity":"high","Description":"SpringBlade is a comprehensive project upgraded and optimized from a commercial-grade project, featuring both a SpringCloud distributed microservice architecture and a SpringBoot monolithic microservice architecture. The SpringBlade framework has a default SIGN_KEY, which can be exploited by attackers to obtain sensitive information such as user account password logs.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2021/CVE-2021-44910.yaml"}
{"ID":"CVE-2021-45027","Info":{"Name":"Oliver 5 Library Server \u003c8.00.008.053 - Local File Inclusion","Severity":"high","Description":"Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-45027.yaml"}
@@ -1756,6 +1763,7 @@
{"ID":"CVE-2021-45046","Info":{"Name":"Apache Log4j2 - Remote Code Injection","Severity":"critical","Description":"Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2021/CVE-2021-45046.yaml"}
{"ID":"CVE-2021-45092","Info":{"Name":"Thinfinity Iframe Injection","Severity":"critical","Description":"A vulnerability exists in Thinfinity VirtualUI in a function located in /lab.html reachable which by default could allow IFRAME injection via the \"vpath\" parameter.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45092.yaml"}
{"ID":"CVE-2021-45232","Info":{"Name":"Apache APISIX Dashboard \u003c2.10.1 - API Unauthorized Access","Severity":"critical","Description":"In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin.' While all APIs and authentication middleware are developed based on framework `droplet`, some API directly use the interface of framework `gin` thus bypassing their authentication.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45232.yaml"}
{"ID":"CVE-2021-45328","Info":{"Name":"Gitea \u003c 1.4.3 - Open Redirect","Severity":"medium","Description":"Gitea before version 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. The vulnerability exists in the redirect_to parameter used on the login page (/user/login). Due to improper validation of the redirect URL, an attacker can craft a malicious link that redirects authenticated users to an arbitrary external website after login.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-45328.yaml"}
{"ID":"CVE-2021-45380","Info":{"Name":"AppCMS - Cross-Site Scripting","Severity":"medium","Description":"AppCMS 2.0.101 has a cross-site scripting vulnerability in \\templates\\m\\inc_head.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-45380.yaml"}
{"ID":"CVE-2021-45382","Info":{"Name":"D-Link - Remote Command Execution","Severity":"critical","Description":"A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45382.yaml"}
{"ID":"CVE-2021-45420","Info":{"Name":"Emerson Dixell XWEB-500 - Arbitrary File Write","Severity":"critical","Description":"Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi, letting attackers write any file on the system, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45420.yaml"}
@@ -1798,7 +1806,7 @@
{"ID":"CVE-2022-0206","Info":{"Name":"WordPress NewStatPress \u003c1.3.6 - Cross-Site Scripting","Severity":"medium","Description":"WordPress NewStatPress plugin before 1.3.6 is susceptible to cross-site scripting. The plugin does not properly escape the whatX parameters before outputting them back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0206.yaml"}
{"ID":"CVE-2022-0208","Info":{"Name":"WordPress Plugin MapPress \u003c2.73.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Plugin MapPress before version 2.73.4 does not sanitize and escape the 'mapid' parameter before outputting it back in the \"Bad mapid\" error message, leading to reflected cross-site scripting.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0208.yaml"}
{"ID":"CVE-2022-0212","Info":{"Name":"WordPress Spider Calendar \u003c=1.5.65 - Cross-Site Scripting","Severity":"medium","Description":"WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0212.yaml"}
{"ID":"CVE-2022-0218","Info":{"Name":"HTML Email Template Designer \u003c 3.1 - Stored Cross-Site Scripting","Severity":"medium","Description":"WordPress Email Template Designer WP HTML Mail allows stored cross-site scripting through an unprotected REST-API endpoint.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0218.yaml"}
{"ID":"CVE-2022-0218","Info":{"Name":"HTML Email Template Designer \u003c 3.1 - Missing Authorization on Rest Route","Severity":"medium","Description":"The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers toretrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0218.yaml"}
{"ID":"CVE-2022-0220","Info":{"Name":"WordPress GDPR \u0026 CCPA \u003c1.9.27 - Cross-Site Scripting","Severity":"medium","Description":"WordPress GDPR \u0026 CCPA plugin before 1.9.27 contains a cross-site scripting vulnerability. The check_privacy_settings AJAX action, available to both unauthenticated and authenticated users, responds with JSON data without an \"application/json\" content-type, and JavaScript code may be executed on a victim's browser.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0220.yaml"}
{"ID":"CVE-2022-0228","Info":{"Name":"Popup Builder \u003c 4.0.7 - SQL Injection","Severity":"high","Description":"The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-0228.yaml"}
{"ID":"CVE-2022-0234","Info":{"Name":"WordPress WOOCS \u003c 1.3.7.5 - Cross-Site Scripting","Severity":"medium","Description":"WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0234.yaml"}
@@ -2814,6 +2822,7 @@
{"ID":"CVE-2023-49103","Info":{"Name":"OwnCloud - Phpinfo Configuration","Severity":"high","Description":"An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-49103.yaml"}
{"ID":"CVE-2023-49230","Info":{"Name":"Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload","Severity":"high","Description":"A vulnerability in Peplink Balance Two prior to version 8.4.0 allows unauthenticated attackers to modify captive portal configurations due to a missing authorization check. Specifically, attackers can upload files via /guest/portal_admin_upload.cgi, with the changes reflected at /guest/preview.cgi?portal_id=1.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-49230.yaml"}
{"ID":"CVE-2023-49293","Info":{"Name":"Vite dev server - Cross-Site Scripting","Severity":"medium","Description":"Vite's dev server, when used with `appType: 'custom'` and manually invoking `server.transformIndexHtml` using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script (`\u003cscript type=\"module\"\u003e...\u003c/script\u003e`), an attacker can inject a script via the URL, potentially leading to XSS in the browser. The vulnerability only affects certain custom SSR/dev configurations, not plain `vite dev`.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49293.yaml"}
{"ID":"CVE-2023-49438","Info":{"Name":"Python Flask-Security-Too \u003c=5.3.2 - Open Redirect","Severity":"medium","Description":"An open redirect vulnerability exists in the python package Flask-Security-Too prior to version 5.3.3. Attackers can abuse the 'next' parameter on the /login and /register routes to redirect unsuspecting users to malicious sites via crafted URLs, which could lead to phishing or other attacks ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-49438)).\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49438.yaml"}
{"ID":"CVE-2023-49489","Info":{"Name":"KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)","Severity":"medium","Description":"Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49489.yaml"}
{"ID":"CVE-2023-49494","Info":{"Name":"DedeCMS v5.7.111 - Cross-Site Scripting","Severity":"medium","Description":"DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49494.yaml"}
{"ID":"CVE-2023-4966","Info":{"Name":"Citrix Bleed - Leaking Session Tokens","Severity":"high","Description":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-4966.yaml"}
@@ -2899,6 +2908,7 @@
{"ID":"CVE-2023-7164","Info":{"Name":"WordPress BackWPup \u003c 4.0.4 - Backup File Disclosure","Severity":"high","Description":"BackWPup WordPress plugin \u003c 4.0.4 contains a directory listing vulnerability caused by lack of access restrictions in its temporary backup folder, letting unauthenticated attackers download site backups, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-7164.yaml"}
{"ID":"CVE-2023-7165","Info":{"Name":"JetBackup \u003c= 2.0.9.7 - Sensitive Information Exposure via Directory Listing","Severity":"high","Description":"JetBackup WordPress plugin \u003c= 2.0.9.9 does not use index files to prevent directory listing in certain configurations, letting malicious actors leak backup files, exploit requires access to the web server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-7165.yaml"}
{"ID":"CVE-2023-7246","Info":{"Name":"System Dashboard \u003c 2.8.10 - Cross-Site Scripting","Severity":"medium","Description":"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks through header injection, specifically in the X-Forwarded-For header.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-7246.yaml"}
{"ID":"CVE-2023-7327","Info":{"Name":"Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read","Severity":"high","Description":"An arbitrary file read vulnerability, also known as a \"path traversal\" or \"directory traversal\" vulnerability, occurs when an attacker is able to access files on a system that they shouldn't have access to. This vulnerability arises from improper input validation or insufficient access controls in an application.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-7327.yaml"}
{"ID":"CVE-2023-7337","Info":{"Name":"JS Help Desk \u003c= 2.8.2 - SQL Injection","Severity":"critical","Description":"JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-7337.yaml"}
{"ID":"CVE-2024-0012","Info":{"Name":"PAN-OS Management Web Interface - Authentication Bypass","Severity":"critical","Description":"An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-0012.yaml"}
{"ID":"CVE-2024-0195","Info":{"Name":"SpiderFlow Crawler Platform - Remote Code Execution","Severity":"critical","Description":"A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-0195.yaml"}
@@ -2929,6 +2939,7 @@
{"ID":"CVE-2024-1061","Info":{"Name":"WordPress HTML5 Video Player - SQL Injection","Severity":"critical","Description":"WordPress HTML5 Video Player plugin is vulnerable to SQL injection. An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-1061.yaml"}
{"ID":"CVE-2024-10708","Info":{"Name":"System Dashboard \u003c 2.8.15 - Admin+ Path Traversal","Severity":"medium","Description":"The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server\n","Classification":{"CVSSScore":"4.9"}},"file_path":"http/cves/2024/CVE-2024-10708.yaml"}
{"ID":"CVE-2024-1071","Info":{"Name":"WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection","Severity":"critical","Description":"The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction \u0026 Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-1071.yaml"}
{"ID":"CVE-2024-10763","Info":{"Name":"WordPress Campress Theme \u003c= 1.35 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campress_woocommerce_get_ajax_products' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-10763.yaml"}
{"ID":"CVE-2024-10783","Info":{"Name":"WordPress Plugin MainWP Child - Authentication Bypass","Severity":"high","Description":"The plugin is vulnerable to an authentication bypass that allows an unauthenticated user to login as an administrator without providing a password. This vulnerability is only exploitable when the plugin has not been connected to a MainWP Dashboard and the \"Require unique security ID\" option is not enabled (it is disabled by default).\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2024/CVE-2024-10783.yaml"}
{"ID":"CVE-2024-10812","Info":{"Name":"GPT Academic v1.3.9 - Open Redirect","Severity":"medium","Description":"An open redirect vulnerability exists in GPT Academic v1.3.9, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-10812.yaml"}
{"ID":"CVE-2024-10908","Info":{"Name":"FastChat - Open Redirect","Severity":"medium","Description":"Detects an open redirect vulnerability in lm-sys/fastchat version 0.2.36, which allows attackers to redirect users to malicious URLs.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-10908.yaml"}
@@ -3072,6 +3083,7 @@
{"ID":"CVE-2024-25735","Info":{"Name":"WyreStorm Apollo VX20 - Information Disclosure","Severity":"high","Description":"An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext credentials for the SoftAP (access point) Router /device/config using an HTTP GET request.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-25735.yaml"}
{"ID":"CVE-2024-25852","Info":{"Name":"Linksys RE7000 - Command Injection","Severity":"high","Description":"Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the \"AccessControlList\" parameter of the access control function point\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-25852.yaml"}
{"ID":"CVE-2024-2621","Info":{"Name":"Fujian Kelixin Communication - Command Injection","Severity":"medium","Description":"A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwd_update.php.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-2621.yaml"}
{"ID":"CVE-2024-26291","Info":{"Name":"Avid NEXIS Agent - Arbitrary File Read","Severity":"high","Description":"Avid NEXIS E-series, F-series, PRO+, and System Director Appliance (SDA+) before 2025.5.1 contain an unauthenticated arbitrary file read caused by improper validation of the filename parameter, letting unauthenticated attackers read sensitive files, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-26291.yaml"}
{"ID":"CVE-2024-26331","Info":{"Name":"ReCrystallize Server - Authentication Bypass","Severity":"high","Description":"This vulnerability allows an attacker to bypass authentication in the ReCrystallize Server application by manipulating the 'AdminUsername' cookie. This gives the attacker administrative access to the application's functionality, even when the default password has been changed.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-26331.yaml"}
{"ID":"CVE-2024-2667","Info":{"Name":"InstaWP Connect \u003c= 0.1.0.22 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The InstaWP Connect – 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-2667.yaml"}
{"ID":"CVE-2024-27115","Info":{"Name":"SOPlanning - Remote Code Execution","Severity":"high","Description":"Detects a remote code execution vulnerability in SOPlanning version 1.52.01 through authenticated PHP file upload.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2024/CVE-2024-27115.yaml"}
@@ -3145,6 +3157,7 @@
{"ID":"CVE-2024-31851","Info":{"Name":"CData Sync \u003c 23.4.8843 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability exists in the Java version of CData Sync \u003c 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-31851.yaml"}
{"ID":"CVE-2024-31982","Info":{"Name":"XWiki \u003c 4.10.20 - Remote code execution","Severity":"critical","Description":"XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-31982.yaml"}
{"ID":"CVE-2024-32113","Info":{"Name":"Apache OFBiz Directory Traversal - Remote Code Execution","Severity":"high","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32113.yaml"}
{"ID":"CVE-2024-32114","Info":{"Name":"Apache ActiveMQ 6.x \u003c 6.1.2 - Broken Access Control","Severity":"high","Description":"Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-32114.yaml"}
{"ID":"CVE-2024-32128","Info":{"Name":"WordPress Realtyna Organic IDX Plugin \u003c= 4.14.4 - Unauthenticated SQL Injection","Severity":"critical","Description":"The Realtyna Organic IDX plugin plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.14.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32128.yaml"}
{"ID":"CVE-2024-32231","Info":{"Name":"Stash \u003c 0.26.0 - SQL Injection","Severity":"critical","Description":"Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32231.yaml"}
{"ID":"CVE-2024-32238","Info":{"Name":"H3C ER8300G2-X - Password Disclosure","Severity":"critical","Description":"H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login interface.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32238.yaml"}
@@ -3162,6 +3175,7 @@
{"ID":"CVE-2024-32738","Info":{"Name":"CyberPower - SQL Injection","Severity":"high","Description":"A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-32738.yaml"}
{"ID":"CVE-2024-32739","Info":{"Name":"CyberPower \u003c v2.8.3 - SQL Injection","Severity":"high","Description":"A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-32739.yaml"}
{"ID":"CVE-2024-3274","Info":{"Name":"D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in D-Link DNS-320L, DNS-320LW and DNS-327L up to 20240403 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/info.cgi of the component HTTP GET Request Handler.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-3274.yaml"}
{"ID":"CVE-2024-32825","Info":{"Name":"Simply Static - Information Disclosure","Severity":"medium","Description":"Patrick Posner Simply Static versions up to 3.1.3 contain a vulnerability for insertion of sensitive information into log files caused by improper handling of log data, letting attackers potentially access sensitive information, exploit requires no specific privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32825.yaml"}
{"ID":"CVE-2024-32870","Info":{"Name":"iTop Hub Connector - Information Disclosure","Severity":"medium","Description":"Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2024/CVE-2024-32870.yaml"}
{"ID":"CVE-2024-32964","Info":{"Name":"Lobe Chat \u003c= v0.150.5 - Server-Side Request Forgery","Severity":"critical","Description":"Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2024/CVE-2024-32964.yaml"}
{"ID":"CVE-2024-3300","Info":{"Name":"Delmia Apriso - Pre-Authentication Unsafe .NET Object Deserialization","Severity":"critical","Description":"An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2024/CVE-2024-3300.yaml"}
@@ -3198,6 +3212,7 @@
{"ID":"CVE-2024-36401","Info":{"Name":"GeoServer RCE in Evaluating Property Name Expressions","Severity":"critical","Description":"In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36401.yaml"}
{"ID":"CVE-2024-36404","Info":{"Name":"GeoServer and GeoTools - Remote Code Execution","Severity":"critical","Description":"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36404.yaml"}
{"ID":"CVE-2024-36412","Info":{"Name":"SuiteCRM - SQL Injection","Severity":"critical","Description":"SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36412.yaml"}
{"ID":"CVE-2024-36420","Info":{"Name":"Flowise 1.4.3 - Arbitrary File Read","Severity":"high","Description":"Flowise 1.4.3 contains a path traversal caused by lack of sanitization of 'fileName' parameter in /api/v1/openai-assistants-file endpoint in index.ts, letting attackers read arbitrary files, exploit requires attacker to send crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-36420.yaml"}
{"ID":"CVE-2024-36527","Info":{"Name":"Puppeteer Renderer - Directory Traversal","Severity":"medium","Description":"puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36527.yaml"}
{"ID":"CVE-2024-3656","Info":{"Name":"Keycloak \u003c 24.0.5 - Broken Access Control","Severity":"high","Description":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2024/CVE-2024-3656.yaml"}
{"ID":"CVE-2024-36675","Info":{"Name":"LyLme spage v1.9.5 - Server-Side Request Forgery","Severity":"high","Description":"LyLme spage v1.9.5 is vulnerable to server-side request forgery (SSRF) via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36675.yaml"}
@@ -3229,6 +3244,7 @@
{"ID":"CVE-2024-3850","Info":{"Name":"Uniview NVR301-04S2-P4 - Cross-Site Scripting","Severity":"medium","Description":"Uniview NVR301-04S2-P4 contains a reflected cross-site scripting vulnerability via the PATH of LAPI. CISA and Uniview state that this vulnerability needs to be authenticated. This is incorrect. Any PATH payload can cause XSS. A submission to Mitre has been sent to update the verbiage in the finding as well as the CVSS score.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-3850.yaml"}
{"ID":"CVE-2024-38514","Info":{"Name":"NextChat - Server-Side Request Forgery","Severity":"high","Description":"NextChat v2.12.3 suffers from a Server-Side Request Forgery (SSRF) and Cross-Site Scripting vulnerability due to a lack of validation of the GET parameter on the WebDav API endpoint.\n","Classification":{"CVSSScore":"7.4"}},"file_path":"http/cves/2024/CVE-2024-38514.yaml"}
{"ID":"CVE-2024-38653","Info":{"Name":"Ivanti Avalanche SmartDeviceServer - XML External Entity","Severity":"high","Description":"XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38653.yaml"}
{"ID":"CVE-2024-38773","Info":{"Name":"FormLift for Infusionsoft Web Forms \u003c= 7.5.17 - SQL Injection","Severity":"critical","Description":"The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to SQL Injection via the 'form_id' parameter in versions up to, and including, 7.5.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2024/CVE-2024-38773.yaml"}
{"ID":"CVE-2024-38816","Info":{"Name":"WebMvc.fn/WebFlux.fn - Path Traversal","Severity":"high","Description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38816.yaml"}
{"ID":"CVE-2024-38819","Info":{"Name":"Spring Framework Path Traversal in Functional Web Frameworks","Severity":"high","Description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. The application is vulnerable when it uses RouterFunctions to serve static resources and resource handling is explicitly configured with a FileSystemResource location. This is similar to CVE-2024-38816, but with different input. Unlike CVE-2024-38816, applications deployed on Tomcat or Jetty are also vulnerable.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38819.yaml"}
{"ID":"CVE-2024-38856","Info":{"Name":"Apache OFBiz - Improper Authorization \u0026 Remote Code Execution","Severity":"critical","Description":"Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-38856.yaml"}
@@ -3258,6 +3274,7 @@
{"ID":"CVE-2024-4295","Info":{"Name":"Email Subscribers by Icegram Express \u003c= 5.7.20 - Unauthenticated SQL Injection via Hash","Severity":"critical","Description":"Email Subscribers by Icegram Express \u003c= 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-4295.yaml"}
{"ID":"CVE-2024-43144","Info":{"Name":"Cost Calculator Builder \u003c= 3.2.15 - SQL Injection","Severity":"critical","Description":"The Cost Calculator Builder plugin for WordPress is vulnerable to SQL Injection via discount codes in versions up to, and including, 3.2.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-43144.yaml"}
{"ID":"CVE-2024-43160","Info":{"Name":"BerqWP \u003c= 1.7.6 - Arbitrary File Upload","Severity":"critical","Description":"The BerqWP Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/store_webp.php file in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-43160.yaml"}
{"ID":"CVE-2024-4322","Info":{"Name":"LoLLMS WebUI \u003c 9.8 - Path Traversal","Severity":"high","Description":"parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /list_personalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-4322.yaml"}
{"ID":"CVE-2024-4325","Info":{"Name":"Gradio - Server-Side Request Forgery","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-4325.yaml"}
{"ID":"CVE-2024-43283","Info":{"Name":"Contest Gallery - Broken Access Control","Severity":"medium","Description":"Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-43283.yaml"}
{"ID":"CVE-2024-43360","Info":{"Name":"ZoneMinder - SQL Injection","Severity":"critical","Description":"ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-43360.yaml"}
@@ -3303,6 +3320,7 @@
{"ID":"CVE-2024-47374","Info":{"Name":"LiteSpeed Cache \u003c= 6.5.0.2 - Stored XSS","Severity":"high","Description":"LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2024/CVE-2024-47374.yaml"}
{"ID":"CVE-2024-47533","Info":{"Name":"Cobbler 'XML-RPC' - Authentication Bypass","Severity":"critical","Description":"Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-47533.yaml"}
{"ID":"CVE-2024-48248","Info":{"Name":"NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read","Severity":"high","Description":"NAKIVO Backup \u0026 Replication is a data protection solution used for backing up and restoring virtualized and physical environments. A vulnerability has been identified in certain versions of NAKIVO Backup \u0026 Replication that allows an unauthenticated attacker to read arbitrary files on the underlying system.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-48248.yaml"}
{"ID":"CVE-2024-48259","Info":{"Name":"Cloudlog - SQL Injection","Severity":"high","Description":"Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php request_form, letting attackers execute arbitrary SQL commands via station_id or callsign, exploit requires sending crafted request.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-48259.yaml"}
{"ID":"CVE-2024-48307","Info":{"Name":"JeecgBoot v3.7.1 - SQL Injection","Severity":"critical","Description":"The JeecgBoot application is vulnerable to SQL Injection via the `getTotalData` endpoint. An attacker can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-48307.yaml"}
{"ID":"CVE-2024-4836","Info":{"Name":"Edito CMS - Sensitive Data Leak","Severity":"high","Description":"Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthorized user.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-4836.yaml"}
{"ID":"CVE-2024-48360","Info":{"Name":"Qualitor \u003c= v8.24 - Server-Side Request Forgery","Severity":"high","Description":"Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-48360.yaml"}
@@ -3480,6 +3498,7 @@
{"ID":"CVE-2024-9193","Info":{"Name":"WHMpress \u003c= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update","Severity":"critical","Description":"The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9193.yaml"}
{"ID":"CVE-2024-9234","Info":{"Name":"GutenKit \u003c= 2.1.0 - Arbitrary File Upload","Severity":"critical","Description":"The GutenKit Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9234.yaml"}
{"ID":"CVE-2024-9264","Info":{"Name":"Grafana Post-Auth DuckDB - SQL Injection To File Read","Severity":"critical","Description":"The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9264.yaml"}
{"ID":"CVE-2024-9362","Info":{"Name":"Polyaxon - Unauthenticated Directory Traversal","Severity":"high","Description":"Polyaxon latest version contains a path traversal caused by insufficient validation in directory access, letting unauthenticated attackers retrieve directory information and file contents, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-9362.yaml"}
{"ID":"CVE-2024-9463","Info":{"Name":"PaloAlto Networks Expedition - Remote Code Execution","Severity":"critical","Description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9463.yaml"}
{"ID":"CVE-2024-9465","Info":{"Name":"Palo Alto Expedition - SQL Injection","Severity":"high","Description":"An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2024/CVE-2024-9465.yaml"}
{"ID":"CVE-2024-9474","Info":{"Name":"PAN-OS Management Web Interface - Command Injection","Severity":"high","Description":"A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.\nCloud NGFW and Prisma Access are not impacted by this vulnerability.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2024/CVE-2024-9474.yaml"}
@@ -3501,6 +3520,7 @@
{"ID":"CVE-2025-0868","Info":{"Name":"DocsGPT - Unauthenticated Remote Code Execution","Severity":"critical","Description":"A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.This issue affects DocsGPT- from 0.8.1 through 0.12.0.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-0868.yaml"}
{"ID":"CVE-2025-10035","Info":{"Name":"GoAnywhere - Authentication Bypass","Severity":"critical","Description":"Fortra GoAnywhere MFT contains an insecure deserialization vulnerability in the License Servlet caused by deserializing attacker-controlled objects with a valid forged license response signature, letting attackers perform command injection, exploit requires valid forged license signature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-10035.yaml"}
{"ID":"CVE-2025-10090","Info":{"Name":"Jinher OA - SQL Injection","Severity":"high","Description":"jinher jinher_oa is an office automation software that facilitates workflow management and collaboration within organizations. It sits in the enterprise layer of the tech stack, is typically deployed as self_hosted, and—within the information_technology industry—serves the business_apps domain.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2025/CVE-2025-10090.yaml"}
{"ID":"CVE-2025-10162","Info":{"Name":"WordPress OrderConvo \u003c 14 - Path Traversal","Severity":"high","Description":"WooCommerce OrderConvo WordPress plugin \\u003C 14 contains a path traversal vulnerability caused by improper validation of file download paths, letting unauthenticated attackers read or download arbitrary files remotely\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-10162.yaml"}
{"ID":"CVE-2025-10204","Info":{"Name":"AC Smart II - Authentication Bypass","Severity":"high","Description":"AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-10204.yaml"}
{"ID":"CVE-2025-10210","Info":{"Name":"ChanCMS \u003c= 3.3.0 - SQL Injection","Severity":"medium","Description":"yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the \\\"key\\\" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-10210.yaml"}
{"ID":"CVE-2025-10211","Info":{"Name":"ChanCMS \u003c= 3.3.0 - Server-Side Request Forgery","Severity":"medium","Description":"yanyutao0402 ChanCMS 3.3.0 contains a server-side request forgery caused by manipulation of the \"taskUrl\" argument in /cms/collect/getArticle, letting remote attackers make arbitrary requests, exploit requires no special privileges.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-10211.yaml"}
@@ -3508,12 +3528,14 @@
{"ID":"CVE-2025-1025","Info":{"Name":"Cockpit \u003c 2.4.1 - Arbitrary File Upload","Severity":"high","Description":"Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensions to bypass the upload filter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1025.yaml"}
{"ID":"CVE-2025-1035","Info":{"Name":"KLog Server - Path Traversal","Severity":"medium","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1.\n","Classification":{"CVSSScore":"5.7"}},"file_path":"http/cves/2025/CVE-2025-1035.yaml"}
{"ID":"CVE-2025-10353","Info":{"Name":"Melis Technology Melis Platform - Unrestricted File Upload \u0026 Remote Code Execution","Severity":"critical","Description":"Melis Technology Melis Platform contains an unrestricted file upload caused by insufficient validation of 'mcsdetail_img' parameter in /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, letting attackers upload malicious files and achieve remote code execution, exploit requires crafted POST request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-10353.yaml"}
{"ID":"CVE-2025-10897","Info":{"Name":"WooCommerce Designer Pro \u003c= 1.9.28 - Arbitrary File Read","Severity":"high","Description":"WooCommerce Designer Pro theme for WordPress \u003c= 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-10897.yaml"}
{"ID":"CVE-2025-1097","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","Severity":"high","Description":"A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1097.yaml"}
{"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
{"ID":"CVE-2025-11307","Info":{"Name":"WP Google Maps \u003c 9.0.48 - Cross-Site Scripting","Severity":"high","Description":"WP Google Maps WordPress plugin \u003c 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-11307.yaml"}
{"ID":"CVE-2025-11368","Info":{"Name":"LearnPress \u003c 4.3.0 - Arbitrary Callback Execution to Information Exposure","Severity":"medium","Description":"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-11368.yaml"}
{"ID":"CVE-2025-11371","Info":{"Name":"Gladinet CentreStack \u0026 TrioFox - Local File Inclusion","Severity":"medium","Description":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-11371.yaml"}
{"ID":"CVE-2025-11580","Info":{"Name":"PowerJob List - Authorization Bypass","Severity":"medium","Description":"PowerJob = 5.1.2 contains a broken access control caused by missing authorization in /user/list function, letting remote attackers access unauthorized resources, exploit requires no special privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11580.yaml"}
{"ID":"CVE-2025-11693","Info":{"Name":"Export WP Page to Static HTML \u003c= 4.3.4 - Cookie Exposure","Severity":"critical","Description":"Export WP Page to Static HTML \u0026 PDF WordPress plugin \u003c= 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger backup with specific user role.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11693.yaml"}
{"ID":"CVE-2025-11700","Info":{"Name":"N-central - XML External Entities Injection","Severity":"high","Description":"N-central versions \u003c 2025.4 are vulnerable to an XML External Entities injection leading to information disclosure.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11700.yaml"}
{"ID":"CVE-2025-11749","Info":{"Name":"WordPress AI Engine Plugin - Token Exposure","Severity":"critical","Description":"Unauthenticated sensitive information exposure in AI Engine WordPress plugin \u003c= 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11749.yaml"}
{"ID":"CVE-2025-11750","Info":{"Name":"Dify - User Enumeration via \"Account not found\" Message","Severity":"medium","Description":"A user enumeration vulnerability exists in langgenius/dify, where the login API leaks information about whether a user account exists or not. When an invalid/non-existent email is used during login, the API returns a distinct error message such as \"account_not_found\" or \"Account not found.\", allowing attackers to identify valid accounts.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11750.yaml"}
@@ -3523,15 +3545,19 @@
{"ID":"CVE-2025-1232","Info":{"Name":"Site Reviews \u003c 7.2.5 - Unauthenticated Stored XSS","Severity":"high","Description":"Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1232.yaml"}
{"ID":"CVE-2025-12480","Info":{"Name":"Triofox - Improper Access Control","Severity":"critical","Description":"The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely access, view, and potentially interact with the database management interface, risking data disclosure or system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-12480.yaml"}
{"ID":"CVE-2025-12536","Info":{"Name":"SureForms \u003c= 1.13.1 - Sensitive Information Exposure","Severity":"medium","Description":"SureForms WordPress plugin \u003c= 1.13.1 contains a sensitive information exposure caused by setting 'auth_callback' to '__return_true' in '_srfm_email_notification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-12536.yaml"}
{"ID":"CVE-2025-12841","Info":{"Name":"WordPress Bookit \u003c 2.5.1 - Unauthenticated Stripe Settings Update","Severity":"high","Description":"Bookit WordPress plugin \u003c 2.5.1 contains a broken access control vulnerability caused by a publicly accessible REST endpoint allowing unauthenticated update of Stripe payment options, letting remote attackers modify payment settings without authentication.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-12841.yaml"}
{"ID":"CVE-2025-1302","Info":{"Name":"JSONPath Plus \u003c 10.3.0 - Remote Code Execution","Severity":"critical","Description":"Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1302.yaml"}
{"ID":"CVE-2025-1303","Info":{"Name":"Plugin Oficial – Getnet para WooCommerce \u003c= 1.8.0 - Cross-Site Scripting","Severity":"medium","Description":"The Plugin Oficial – Getnet para WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on the 'page' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-1303.yaml"}
{"ID":"CVE-2025-13138","Info":{"Name":"WP Directory Kit \u003c= 1.4.3 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-13138.yaml"}
{"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
{"ID":"CVE-2025-13315","Info":{"Name":"Twonky Server 8.5.2 on Linux and Windows - Log File Exposure","Severity":"critical","Description":"Twonky Server 8.5.2 contains a broken access control vulnerability caused by bypassing web service API authentication, letting unauthenticated attackers read log files with administrator credentials, exploit requires no authentication\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-13315.yaml"}
{"ID":"CVE-2025-1338","Info":{"Name":"NUUO Camera \u003c=20250203 - OS Command Injection","Severity":"critical","Description":"NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handle_config.php, letting remote attackers execute arbitrary commands, exploit requires remote access.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-1338.yaml"}
{"ID":"CVE-2025-13390","Info":{"Name":"WP Directory Kit \u003c= 1.4.4 - Authentication Bypass","Severity":"critical","Description":"The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism that uses only the first 10 characters of MD5(user_id). For user_id=1 (typically admin), the token is always predictable.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-13390.yaml"}
{"ID":"CVE-2025-13418","Info":{"Name":"Responsive Pricing Table \u003c= 5.1.12 - Cross-Site Scripting","Severity":"medium","Description":"The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts that execute when an admin views the pricing table edit page.\n","Classification":{"CVSSScore":"6.4"}},"file_path":"http/cves/2025/CVE-2025-13418.yaml"}
{"ID":"CVE-2025-13486","Info":{"Name":"Advanced Custom Fields Extended \u003c 0.9.2 - Remote Code Execution","Severity":"critical","Description":"Advanced Custom Fields: Extended WordPress plugin 0.9.0.5 through 0.9.1.1 contains a remote code execution caused by unsafe use of call_user_func_array() in prepare_form() function, letting unauthenticated attackers execute arbitrary code remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-13486.yaml"}
{"ID":"CVE-2025-1361","Info":{"Name":"IP2Location Country Blocker \u003c 2.38.9 - Unauthenticated Information Disclosure","Severity":"high","Description":"IP2Location Country Blocker plugin for WordPress up to version 2.38.8 contains a regular information exposure caused by missing capability checks on admin_init(), letting unauthenticated attackers view plugin settings, exploit requires no special conditions.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1361.yaml"}
{"ID":"CVE-2025-13652","Info":{"Name":"WordPress CBX Bookmark \u0026 Favorite Plugin \u003c= 2.0.4 - SQL Injection","Severity":"critical","Description":"CBX Bookmark \u0026 Favorite WordPress plugin \u003c= 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-13652.yaml"}
{"ID":"CVE-2025-13801","Info":{"Name":"Yoco Payments \u003c= 3.8.8 - Path Traversal","Severity":"high","Description":"Yoco Payments WordPress plugin \u003c= 3.8.8 contains a path traversal caused by improper validation of the file parameter, letting unauthenticated attackers read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-13801.yaml"}
{"ID":"CVE-2025-13920","Info":{"Name":"WP Directory Kit \u003c 1.5.0 - Unauthenticated Email Exposure","Severity":"medium","Description":"WP Directory Kit plugin for WordPress \u003c= 1.4.9 contains a sensitive information exposure caused by improper access control in wdk_public_action AJAX handler, letting unauthenticated attackers extract email addresses of users with Directory Kit-specific roles.\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-13920.yaml"}
{"ID":"CVE-2025-13956","Info":{"Name":"LearnPress \u003c 4.3.2 - Broken Access Control","Severity":"medium","Description":"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-13956.yaml"}
{"ID":"CVE-2025-14124","Info":{"Name":"Team WordPress Plugin (TLP Team) \u003c= 5.0.9 - SQL Injection","Severity":"high","Description":"Team WordPress plugin \u003c= 5.0.11 contains a SQL injection caused by improper sanitization and escaping of a parameter in an AJAX action accessible to unauthenticated users, letting remote attackers execute arbitrary SQL commands.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-14124.yaml"}
@@ -3540,6 +3566,7 @@
{"ID":"CVE-2025-14437","Info":{"Name":"WordPress Hummingbird \u003c= 3.18.0 - Sensitive Information Exposure via Log File","Severity":"high","Description":"Hummingbird Performance WordPress plugin \u003c= 3.18.0 contains a sensitive information exposure caused by improper handling in the 'request' function, letting unauthenticated attackers extract sensitive data including Cloudflare API credentials, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-14437.yaml"}
{"ID":"CVE-2025-14528","Info":{"Name":"D-Link DIR-803 - Authentication Bypass","Severity":"high","Description":"An authentication bypass vulnerability exists in D-Link DIR-803 routers (firmware A1 1.04 and earlier). By manipulating the AUTHORIZED_GROUP parameter in /getcfg.php via newline injection, an attacker can retrieve XML configuration containing administrator credentials without authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-14528.yaml"}
{"ID":"CVE-2025-14611","Info":{"Name":"Gladinet CentreStack \u0026 Triofox - Hardcoded Credentials","Severity":"critical","Description":"Gladinet CentreStack and Triofox \u003c 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-14611.yaml"}
{"ID":"CVE-2025-14726","Info":{"Name":"WordPress Widgets for Social Photo Feed \u003c= 1.8 - Information Disclosure","Severity":"medium","Description":"Widgets for Social Photo Feed WordPress plugin \u003c= 1.8 contains a broken access control caused by missing capability checks on specific REST API endpoints, letting unauthenticated attackers access and modify plugin settings remotely.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-14726.yaml"}
{"ID":"CVE-2025-15503","Info":{"Name":"Sangfor OSM - Arbitrary File Upload","Severity":"critical","Description":"Sangfor Operation and Maintenance Management System \u003c= 3.0.8 contains an unrestricted file upload vulnerability caused by manipulation of the \\\"File\\\" argument in /fort/trust/version/common/common.jsp, letting remote attackers upload arbitrary files, exploit requires no special privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-15503.yaml"}
{"ID":"CVE-2025-1562","Info":{"Name":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control","Severity":"critical","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1562.yaml"}
{"ID":"CVE-2025-1595","Info":{"Name":"EasyCVR \u003c=2.1.2 - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1595.yaml"}
@@ -3561,6 +3588,7 @@
{"ID":"CVE-2025-2294","Info":{"Name":"Kubio AI Page Builder \u003c= 2.5.1 - Local File Inclusion","Severity":"critical","Description":"The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2294.yaml"}
{"ID":"CVE-2025-22952","Info":{"Name":"Elestio Memos \u003c= v0.24.0 - Server-Side Request Forgery","Severity":"critical","Description":"elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-22952.yaml"}
{"ID":"CVE-2025-23061","Info":{"Name":"Mongoose - NoSQL Injection","Severity":"critical","Description":"NoSQL injection vulnerability in Mongoose \u003c 8.9.5 affecting the populate() function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operators like $and, allowing execution of arbitrary JavaScript code on MongoDB server, bypassing authentication, and accessing sensitive administrative data.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2025/CVE-2025-23061.yaml"}
{"ID":"CVE-2025-23211","Info":{"Name":"Tandoor Recipes \u003c 1.5.24 - Jinja2 SSTI RCE","Severity":"critical","Description":"Tandoor Recipes \u003c 1.5.24 has a Jinja2 SSTI vulnerability that allows command execution via recipe steps.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-23211.yaml"}
{"ID":"CVE-2025-24016","Info":{"Name":"Wazuh - Unsafe Deserialization Remote Code Execution","Severity":"critical","Description":"A critical Remote Code Execution (RCE) vulnerability exists in Wazuh server versions \u003e= 4.4.0 and \u003c 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using as_wazuh_object in the framework/wazuh/core/cluster/common.py file. An attacker with API access can exploit this vulnerability by injecting an unsanitized dictionary into DAPI requests, leading to arbitrary Python code execution.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-24016.yaml"}
{"ID":"CVE-2025-24354","Info":{"Name":"Imgproxy \u003c 3.27.2 - Server-Side Request Forgery (SSRF)","Severity":"medium","Description":"imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES is set to false, letting local services be exposed, exploit requires network access.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-24354.yaml"}
{"ID":"CVE-2025-24514","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation","Severity":"high","Description":"A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-24514.yaml"}
@@ -3631,20 +3659,24 @@
{"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
{"ID":"CVE-2025-32257","Info":{"Name":"1 Click WordPress Migration \u003c= 2.2 - Unauthenticated Information Disclsoure","Severity":"medium","Description":"1 Click WordPress Migration \u003c= 2.2 contains an information disclosure caused by uncleared debug information, letting attackers retrieve embedded sensitive data, exploit requires no specific privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32257.yaml"}
{"ID":"CVE-2025-32355","Info":{"Name":"Rocket TRUfusion Enterprise - Server Side Request Forgery","Severity":"high","Description":"Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a way that allows specifying absolute URLs in the HTTP request line, causing the proxy to load the given resource.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32355.yaml"}
{"ID":"CVE-2025-32395","Info":{"Name":"Vite - Path Traversal","Severity":"medium","Description":"Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '#' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network and running on Node or Bun.\n","Classification":{"CVSSScore":"6.0"}},"file_path":"http/cves/2025/CVE-2025-32395.yaml"}
{"ID":"CVE-2025-32429","Info":{"Name":"XWiki Platform - SQL Injection","Severity":"critical","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32429.yaml"}
{"ID":"CVE-2025-32430","Info":{"Name":"XWiki Platform - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform versions \u003e= 4.2-milestone-3 and \u003c 16.4.8, \u003e= 16.5.0-rc-1 and \u003c 16.10.6, and \u003e= 17.0.0-rc-1 and \u003c 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32430.yaml"}
{"ID":"CVE-2025-32432","Info":{"Name":"CraftCMS - Remote Code Execution","Severity":"critical","Description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-32432.yaml"}
{"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
{"ID":"CVE-2025-32614","Info":{"Name":"EventON Lite \u003c= 2.4 - Authenticated Local File Inclusion","Severity":"high","Description":"Ashan Perera EventON contains a PHP remote file inclusion caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires attacker to control include filename.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-32614.yaml"}
{"ID":"CVE-2025-32778","Info":{"Name":"Web-Check \u003c 2.0.1 Screenshot API - OS Command Injection","Severity":"critical","Description":"Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32778.yaml"}
{"ID":"CVE-2025-32813","Info":{"Name":"Infoblox NetMRI \u003c 7.6.1 - Unauthenticated Command Injection in get_saml_request","Severity":"high","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-32813.yaml"}
{"ID":"CVE-2025-32814","Info":{"Name":"NetMRI Unauthenticated SQL Injection via skipjackUsername","Severity":"critical","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32814.yaml"}
{"ID":"CVE-2025-32815","Info":{"Name":"NetMRI \u003c 7.6.1 - Authentication Bypass via Hardcoded Credentials","Severity":"medium","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32815.yaml"}
{"ID":"CVE-2025-32966","Info":{"Name":"DataEase 2.10.4-2.10.7 - Remote Code Execution","Severity":"critical","Description":"DataEase prior to version 2.10.8 contains a remote code execution caused by insecure backend JDBC link handling, letting authenticated users execute arbitrary code, exploit requires user authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32966.yaml"}
{"ID":"CVE-2025-32969","Info":{"Name":"XWiki REST API Query - SQL Injection","Severity":"critical","Description":"A SQL injection vulnerability exists in XWiki's REST API query endpoint. An unauthenticated attacker can execute arbitrary SQL queries through the 'q' parameter by manipulating the HQL query, potentially leading to data exfiltration or system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32969.yaml"}
{"ID":"CVE-2025-32970","Info":{"Name":"XWiki WYSIWYG API - Open Redirect","Severity":"medium","Description":"A vulnerability in XWiki's WYSIWYG API allows an attacker to redirect users to arbitrary external URLs through the xerror parameter. This could be used in phishing attacks to redirect users to malicious websites.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-32970.yaml"}
{"ID":"CVE-2025-34023","Info":{"Name":"Karel IP Phone IP1211 Web Management Panel - Local File Inclusion","Severity":"high","Description":"Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34023.yaml"}
{"ID":"CVE-2025-34026","Info":{"Name":"Versa Concerto Actuator Endpoint - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34026.yaml"}
{"ID":"CVE-2025-34027","Info":{"Name":"Versa Concerto API Path Based - Authentication Bypass","Severity":"critical","Description":"Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34027.yaml"}
{"ID":"CVE-2025-34028","Info":{"Name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","Severity":"critical","Description":"A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-34028.yaml"}
{"ID":"CVE-2025-34030","Info":{"Name":"sar2html \u003c=3.2.2 Plot Parameter - Remote Code Execution","Severity":"critical","Description":"sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-34030.yaml"}
{"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
{"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
{"ID":"CVE-2025-34035","Info":{"Name":"EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution","Severity":"critical","Description":"An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-34035.yaml"}
@@ -3677,6 +3709,7 @@
{"ID":"CVE-2025-40630","Info":{"Name":"IceWarp Mail Server ≤11.4.0 - Open Redirect","Severity":"medium","Description":"IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-40630.yaml"}
{"ID":"CVE-2025-4078","Info":{"Name":"Wangshen SecGate 3600 Path Traversal Vulnerability","Severity":"medium","Description":"Wangshen SecGate 3600 2400 contains a path traversal caused by manipulation of the 'file_name' argument in '?g=log_export_file', letting remote attackers access arbitrary files, exploit requires remote access.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-4078.yaml"}
{"ID":"CVE-2025-4123","Info":{"Name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","Severity":"high","Description":"An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2025/CVE-2025-4123.yaml"}
{"ID":"CVE-2025-41242","Info":{"Name":"Spring Framework - Path Traversal","Severity":"medium","Description":"Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires non-compliant Servlet container configuration.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-41242.yaml"}
{"ID":"CVE-2025-41243","Info":{"Name":"Spring Cloud Gateway Server Webflux - Broken Access Control","Severity":"critical","Description":"Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-41243.yaml"}
{"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
{"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
@@ -3692,6 +3725,7 @@
{"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
{"ID":"CVE-2025-44177","Info":{"Name":"White Star Software ProTop - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-44177.yaml"}
{"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
{"ID":"CVE-2025-4524","Info":{"Name":"WordPress Madara Theme \u003c 2.2.2.1 - Local File Inclusion","Severity":"high","Description":"Madara WordPress theme \u003c= 2.2.2 contains a local file inclusion vulnerability caused by improper sanitization of the 'template' parameter, letting unauthenticated attackers execute arbitrary files on the server, exploit requires crafted request.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-4524.yaml"}
{"ID":"CVE-2025-4576","Info":{"Name":"Liferay Portal \u0026 DXP - Cross-Site Scripting","Severity":"medium","Description":"Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entry_cover_image_caption.jsp, letting remote non-authenticated attackers inject JavaScript.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-4576.yaml"}
{"ID":"CVE-2025-45854","Info":{"Name":"JEHC-BPM - Remote Code Execute","Severity":"critical","Description":"A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM \u003c= v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-45854.yaml"}
{"ID":"CVE-2025-45985","Info":{"Name":"Blink Router - Command Injection","Severity":"critical","Description":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-45985.yaml"}
@@ -3707,15 +3741,18 @@
{"ID":"CVE-2025-47423","Info":{"Name":"Personal Weather Station Dashboard 12 - Directory Traversal","Severity":"high","Description":"Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2025/CVE-2025-47423.yaml"}
{"ID":"CVE-2025-47445","Info":{"Name":"WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download","Severity":"high","Description":"Themewinter Eventin contains a path traversal caused by relative path manipulation, letting attackers access arbitrary files on the server, exploit requires no specific privileges or user interaction.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-47445.yaml"}
{"ID":"CVE-2025-47539","Info":{"Name":"Eventin \u003c= 4.0.26 - Privilege Escalation","Severity":"critical","Description":"The Eventin WordPress plugin before 4.0.27 suffers from an unauthenticated privilege escalation vulnerability. Due to a missing permission check in the a REST API endpoint, unauthenticated attackers can import users with arbitrary roles, including administrator, leading to full site compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47539.yaml"}
{"ID":"CVE-2025-47577","Info":{"Name":"TI WooCommerce Wishlist \u003c= 2.9.2 - Arbitrary File Upload","Severity":"high","Description":"TemplateInvaders TI WooCommerce Wishlist \u003c= 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47577.yaml"}
{"ID":"CVE-2025-47646","Info":{"Name":"PSW Front-end Login \u0026 Registration 1.13 - Weak Password Recovery","Severity":"critical","Description":"PSW Front-end Login \u0026 Registration plugin for WordPress contains a weak password recovery mechanism that can be exploited by unauthenticated attackers. This vulnerability affects versions through 1.13 and allows attackers to potentially gain unauthorized access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47646.yaml"}
{"ID":"CVE-2025-47812","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Remote Code Execution","Severity":"critical","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).\nThe vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection\ninto session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting\nin arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47812.yaml"}
{"ID":"CVE-2025-47813","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Path Disclosure via Overlong UID Cookie","Severity":"medium","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813).\nThe vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an\noverlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further\nexploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-47813.yaml"}
{"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
{"ID":"CVE-2025-48157","Info":{"Name":"WordPress Formality Plugin \u003c= 1.5.9 - Local File Inclusion","Severity":"critical","Description":"Michele Giorgi Formality \u003c= 1.5.9 contains a file inclusion vulnerability caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48157.yaml"}
{"ID":"CVE-2025-48281","Info":{"Name":"MyStyle Custom Product Designer \u003c= 3.21.1 - SQL Injection","Severity":"critical","Description":"The MyStyle Custom Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.21.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-48281.yaml"}
{"ID":"CVE-2025-48703","Info":{"Name":"CWP (Control Web Panel) \u003c 0.9.8.1205 - Remote Code Execution","Severity":"critical","Description":"CWP (Control Web Panel) \u003c 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the t_total parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2025/CVE-2025-48703.yaml"}
{"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
{"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
{"ID":"CVE-2025-48954","Info":{"Name":"Discourse OAuth Social Login - Cross-site Scripting","Severity":"high","Description":"Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2025/CVE-2025-48954.yaml"}
{"ID":"CVE-2025-49002","Info":{"Name":"DataEase - Remote Code Execution","Severity":"high","Description":"DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection template intended only to identify exposed DataEase instances and extract possible version hints for manual verification. It does not attempt authentication bypass, JDBC exploitation, or command execution.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49002.yaml"}
{"ID":"CVE-2025-49029","Info":{"Name":"WordPress Custom Login And Signup Widget Plugin \u003c= 1.0 - Arbitrary Code Execution","Severity":"high","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49029.yaml"}
{"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
{"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
@@ -3788,15 +3825,20 @@
{"ID":"CVE-2025-57822","Info":{"Name":"Next.js Middleware - Server-Side Request Forgery","Severity":"medium","Description":"In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next(), an attacker could exploit this behavior to perform Server-Side Request Forgery (SSRF) attacks.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-57822.yaml"}
{"ID":"CVE-2025-58044","Info":{"Name":"JumpServer - Open Redirect via Referer Header","Severity":"medium","Description":"JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-58044.yaml"}
{"ID":"CVE-2025-58179","Info":{"Name":"Astro Cloudflare Adapter - Server Side Request Forgery","Severity":"high","Description":"Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-58179.yaml"}
{"ID":"CVE-2025-58226","Info":{"Name":"WordPress 3D FlipBook Plugin \u003c= 1.16.17 - Sensitive Information Exposure","Severity":"medium","Description":"The 3D FlipBook WordPress plugin (≤ v1.16.17) has a vulnerability where an unauthenticated AJAX action (fb3d_send_posts) exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-58226.yaml"}
{"ID":"CVE-2025-58360","Info":{"Name":"GeoServer - XML External Entity Injection","Severity":"high","Description":"GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity (XXE) injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-58360.yaml"}
{"ID":"CVE-2025-58434","Info":{"Name":"Flowise \u003c= 3.0.5 - Account Takeover","Severity":"critical","Description":"Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-58434.yaml"}
{"ID":"CVE-2025-58443","Info":{"Name":"FOGProject \u003c= 1.5.10.1673 - Authentication Bypass","Severity":"critical","Description":"FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-58443.yaml"}
{"ID":"CVE-2025-58751","Info":{"Name":"Vite Dev Server - Path Traversal","Severity":"low","Description":"Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-58751.yaml"}
{"ID":"CVE-2025-59049","Info":{"Name":"Mockoon \u003c 9.2.0 - Path Traversal","Severity":"high","Description":"Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-59049.yaml"}
{"ID":"CVE-2025-59136","Info":{"Name":"WordPress Gerencianet Oficial \u003c= 3.1.3 - Unauthenticated Order Status Disclosure","Severity":"medium","Description":"Efí Bank Gerencianet Oficial \u003c= 3.1.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data, exploit requires crafted requests.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-59136.yaml"}
{"ID":"CVE-2025-59287","Info":{"Name":"Windows Server Update Service - Insecure Deserialization","Severity":"critical","Description":"Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-59287.yaml"}
{"ID":"CVE-2025-59341","Info":{"Name":"esm.sh \u003c= v136 - Local File Inclusion","Severity":"high","Description":"esm.sh \u003c= 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-59341.yaml"}
{"ID":"CVE-2025-59342","Info":{"Name":"esm.sh \u003c= v136 - Arbitrary File Write via Path Traversal","Severity":"medium","Description":"esm.sh \u003c= 136 contains a path traversal caused by improper canonicalization of the X-Zone-Id HTTP header, letting attackers write files outside the intended storage directory, exploit requires crafted header input.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-59342.yaml"}
{"ID":"CVE-2025-5947","Info":{"Name":"Service Finder Bookings - Authentication Bypass","Severity":"critical","Description":"Service Finder Bookings WordPress plugin \u003c= 6.0 contains a privilege escalation caused by improper validation of user cookie in service_finder_switch_back() function, letting unauthenticated attackers login as any user including admins.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5947.yaml"}
{"ID":"CVE-2025-59474","Info":{"Name":"Jenkins Sidepanel - Unauthorized Agent/Queue Exposure","Severity":"medium","Description":"Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-59474.yaml"}
{"ID":"CVE-2025-59528","Info":{"Name":"Flowise - Remote Code Execution","Severity":"critical","Description":"Flowise 3.0.5 contains a remote code execution vulnerability caused by unsafe evaluation of user input in the CustomMCP node's convertToValidJSONString function, letting remote attackers execute arbitrary code with full Node.js privileges, exploit requires user input to be processed by the vulnerable node.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-59528.yaml"}
{"ID":"CVE-2025-59582","Info":{"Name":"Ajax Load More \u003c 7.6.1 - Unauthenticated Sensitive Information Exposure","Severity":"medium","Description":"The Ajax Load More – Infinite Scroll plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.6.0.2. The plugin's AJAX endpoint (wp_ajax_nopriv_alm_get_posts) allows unauthenticated users to access non-public posts (draft, private, pending, future, trash) by\ninjecting post_status via the custom_args parameter, which bypasses the post_status authorization check in class-alm-queryargs.php.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-59582.yaml"}
{"ID":"CVE-2025-5961","Info":{"Name":"WordPress WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.116 - Authenticated Arbitrary File Upload","Severity":"high","Description":"The Migration, Backup, Staging – WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-5961.yaml"}
{"ID":"CVE-2025-59716","Info":{"Name":"ownCloud Guests - User Enumeration","Severity":"medium","Description":"ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/{email}/{token}, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-59716.yaml"}
{"ID":"CVE-2025-60188","Info":{"Name":"Atarim \u003c 4.2.2 - Sensitive Information Exposure","Severity":"high","Description":"Vito Peleg Atarim \u003c= 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-60188.yaml"}
@@ -3807,9 +3849,11 @@
{"ID":"CVE-2025-61882","Info":{"Name":"Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution","Severity":"critical","Description":"Oracle Concurrent Processing 12.2.3-12.2.14 contains a remote code execution caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access via HTTP.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-61882.yaml"}
{"ID":"CVE-2025-61884","Info":{"Name":"Oracle E-Business Suite - Server-Side Request Forgery","Severity":"high","Description":"Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-61884.yaml"}
{"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
{"ID":"CVE-2025-62039","Info":{"Name":"AI ChatBot with ChatGPT by AYS \u003c= 2.6.6 - Unauthenticated API Key Exposure","Severity":"high","Description":"AYS AI ChatBot with ChatGPT and Content Generator \u003c= 2.6.6 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted input.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-62039.yaml"}
{"ID":"CVE-2025-6204","Info":{"Name":"DELMIA Apriso - Command Injection","Severity":"critical","Description":"An Improper Control of Generation of Code (code injection / file upload → RCE) vulnerability affecting DELMIA Apriso (Release 2020 → Release 2025). When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place executable artifacts into web-served locations (via path traversal or insufficient normalization) and achieve remote code execution under the webserver context.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2025/CVE-2025-6204.yaml"}
{"ID":"CVE-2025-6205","Info":{"Name":"DELMIA Apriso - Broken Access Control","Severity":"high","Description":"DELMIA Apriso Release 2020 through Release 2025 contains a broken access control vulnerability caused by missing authorization, letting attackers gain privileged access to the application, exploit requires no special conditions.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-6205.yaml"}
{"ID":"CVE-2025-62126","Info":{"Name":"WordPress Varnish/Nginx Proxy Caching \u003c= 1.8.3 - Information Exposure","Severity":"medium","Description":"Razvan Stanga Varnish/Nginx Proxy Caching \u003c= 1.8.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted requests.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-62126.yaml"}
{"ID":"CVE-2025-62168","Info":{"Name":"Squid Proxy - HTTP Authentication Credentials Disclosure","Severity":"critical","Description":"Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error page responses. The Authorization header value is embedded in plain text inside the mailto: diagnostic block when Squid generates an error page (e.g. ERR_DNS_FAIL).\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-62168.yaml"}
{"ID":"CVE-2025-62512","Info":{"Name":"Piwigo - User Enumeration via Password Reset","Severity":"medium","Description":"Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-62512.yaml"}
{"ID":"CVE-2025-62522","Info":{"Name":"Vite - Information Disclosure","Severity":"medium","Description":"Vite is a frontend tooling framework for JavaScript.In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-62522.yaml"}
{"ID":"CVE-2025-62613","Info":{"Name":"VDO.Ninja - DOM-Based Cross-Site Scripting","Severity":"medium","Description":"VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-62613.yaml"}
@@ -3834,6 +3878,7 @@
{"ID":"CVE-2025-68645","Info":{"Name":"Zimbra Collaboration - Local File Inclusion","Severity":"high","Description":"Zimbra Collaboration (ZCS) 10.0 and 10.1 contain a local file inclusion caused by improper handling of user-supplied parameters in the RestFilter servlet, letting unauthenticated remote attackers include arbitrary files from WebRoot, exploit requires crafted requests to /h/rest endpoint.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-68645.yaml"}
{"ID":"CVE-2025-69200","Info":{"Name":"phpMyFAQ - Configuration Backup Disclosure","Severity":"high","Description":"phpMyFAQ \u003c= 4.0.16 contains an information disclosure vulnerability caused by unauthenticated access to configuration backup ZIP generation and download, letting remote attackers access sensitive configuration files, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-69200.yaml"}
{"ID":"CVE-2025-6934","Info":{"Name":"The Opal Estate Pro – Property Management \u003c= 1.7.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6934.yaml"}
{"ID":"CVE-2025-69411","Info":{"Name":"ionCube Tester Plus \u003c= 1.3 - Local File Inclusion","Severity":"high","Description":"The ionCube Tester Plus plugin for WordPress versions \u003c= 1.3 is vulnerable to unauthenticated arbitrary file read via path traversal. The 'ininame' parameter in loader-wizard.php is not properly sanitized, allowing attackers to read sensitive files such as wp-config.php and /etc/passwd without authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-69411.yaml"}
{"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
{"ID":"CVE-2025-69971","Info":{"Name":"FUXA \u003c= 1.2.7 - Hardcoded JWT Secret Authentication Bypass","Severity":"critical","Description":"FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-69971.yaml"}
{"ID":"CVE-2025-71243","Info":{"Name":"SPIP Saisies - Remote Code Execution","Severity":"critical","Description":"SPIP Saisies plugin 5.4.0 through 5.11.0 contains a remote code execution caused by an unspecified flaw, letting attackers execute arbitrary code on the server, exploit requires no special conditions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-71243.yaml"}
@@ -3848,11 +3893,15 @@
{"ID":"CVE-2025-8868","Info":{"Name":"Chef Automate \u003c 4.13.295 — SQL Injection","Severity":"critical","Description":"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8868.yaml"}
{"ID":"CVE-2025-8943","Info":{"Name":"Flowise \u003c 3.0.1 - Remote Command Execution","Severity":"critical","Description":"The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8943.yaml"}
{"ID":"CVE-2025-9196","Info":{"Name":"Trinity Audio \u003c= 5.21.0 - Information Exposure","Severity":"medium","Description":"The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-9196.yaml"}
{"ID":"CVE-2025-9209","Info":{"Name":"RestroPress 3.0.0-3.2.1 - Authentication Bypass","Severity":"critical","Description":"RestroPress Online Food Ordering System WordPress plugin 3.0.0 to 3.1.9.2 contains an authentication bypass caused by exposure of user private tokens and API data via /wp-json/wp/v2/users endpoint, letting unauthenticated attackers forge JWT tokens and authenticate as other users including administrators, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-9209.yaml"}
{"ID":"CVE-2025-9316","Info":{"Name":"N-central - Authentication Bypass","Severity":"medium","Description":"N-central \u003c 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9316.yaml"}
{"ID":"CVE-2025-9744","Info":{"Name":"Loan Management System 1.0 - SQL Injection","Severity":"critical","Description":"Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-9744.yaml"}
{"ID":"CVE-2025-9808","Info":{"Name":"The Events Calendar \u003c= 6.15.2 - Information Disclosure","Severity":"medium","Description":"The Events Calendar WordPress plugin \u003c= 6.15.2 contains an information disclosure vulnerability caused by REST endpoint exposure, letting unauthenticated attackers extract data about password-protected vendors or venues, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9808.yaml"}
{"ID":"CVE-2025-9985","Info":{"Name":"Featured Image from URL (FIFU) \u003c= 5.2.7 - Unauthenticated Information Exposure via Log File","Severity":"medium","Description":"The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9985.yaml"}
{"ID":"CVE-2026-0545","Info":{"Name":"MLflow Job API - Authentication Bypass","Severity":"critical","Description":"MLflow latest version contains an authentication bypass caused by unprotected FastAPI job endpoints under /ajax-api/3.0/jobs/* when basic-auth is enabled, letting unauthenticated network clients submit and manage jobs, exploit requires job execution enabled and allowlisted job functions.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-0545.yaml"}
{"ID":"CVE-2026-0560","Info":{"Name":"LolLMS \u003c 2.2.0 - Server-Side Request Forgery","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0. The /api/files/export-content endpoint processes Markdown image URLs by downloading them via _download_image_to_temp() in backend/routers/files.py without any validation, allowing an unauthenticated attacker to supply arbitrary URLs (e.g. cloud metadata endpoints or internal services) that the server will fetch, enabling internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-0560.yaml"}
{"ID":"CVE-2026-0594","Info":{"Name":"WordPress List Site Contributors \u003c 1.1.8 - Reflected XSS","Severity":"medium","Description":"WordPress List Site Contributors plugin \u003c 1.1.8 contains a reflected XSS caused by insufficient sanitization and escaping of the 'alpha' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-0594.yaml"}
{"ID":"CVE-2026-0740","Info":{"Name":"Ninja Forms File Uploads \u003c= 3.3.26 - Arbitrary File Upload","Severity":"critical","Description":"Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0740.yaml"}
{"ID":"CVE-2026-0770","Info":{"Name":"Langflow \u003c 1.3.0 - Remote Code Execution via validate_code() exec()","Severity":"critical","Description":"Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the exec_globals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0770.yaml"}
{"ID":"CVE-2026-0829","Info":{"Name":"Frontend File Manager Plugin \u003c= 23.5 - Unauthenticated Arbitrary Email Sending","Severity":"high","Description":"Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-0829.yaml"}
{"ID":"CVE-2026-0926","Info":{"Name":"Prodigy Commerce \u003c= 3.3.0 - Local File Inclusion","Severity":"critical","Description":"Prodigy Commerce WordPress plugin \u003c= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0926.yaml"}
@@ -3860,7 +3909,9 @@
{"ID":"CVE-2026-1277","Info":{"Name":"URL Shortify \u003c= 1.12.1 - Open Redirect","Severity":"medium","Description":"The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2026/CVE-2026-1277.yaml"}
{"ID":"CVE-2026-1296","Info":{"Name":"Frontend Post Submission Manager Lite \u003c= 1.2.7 - Open Redirect","Severity":"medium","Description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-1296.yaml"}
{"ID":"CVE-2026-1306","Info":{"Name":"WordPress midi-Synth \u003c= 1.1.0 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"WordPress midi-Synth plugin \\u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to obtain a valid nonce exposed in frontend JavaScript.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1306.yaml"}
{"ID":"CVE-2026-1314","Info":{"Name":"WordPress 3D FlipBook \u003c= 1.16.17 - Information Disclosure","Severity":"medium","Description":"WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions \u003c= 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3d_send_posts_in, fb3d_send_post_pages, fb3d_send_posts_in_pages, fb3d_send_posts_in_first_page, and fb3d_send_post_first_page handlers are registered with wp_ajax_nopriv hooks but fail to verify the post status of requested flipbook entries. This allows unauthenticated attackers to retrieve full metadata, PDF URLs, and configuration data of private, draft, and password-protected flipbook posts.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-1314.yaml"}
{"ID":"CVE-2026-1357","Info":{"Name":"WPvivid Backup \u0026 Migration \u003c= 0.9.123 - Arbitrary File Upload","Severity":"critical","Description":"WPvivid Backup \u0026 Migration plugin for WordPress \u003c= 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code execution via wpvivid_action=send_to_site parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1357.yaml"}
{"ID":"CVE-2026-1368","Info":{"Name":"Video Conferencing with Zoom API \u003c 4.6.6 - Unauthenticated SDK Signature Generation","Severity":"high","Description":"Zoom WordPress plugin \u003c 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-1368.yaml"}
{"ID":"CVE-2026-1405","Info":{"Name":"WordPress Slider Future \u003c= 1.0.5 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Slider Future WordPress plugin \u003c= 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'slider_future_handle_image_upload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1405.yaml"}
{"ID":"CVE-2026-1492","Info":{"Name":"WordPress User Registration \u0026 Membership \u003c= 5.1.2 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"User Registration \u0026 Membership WordPress plugin \u003c= 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1492.yaml"}
{"ID":"CVE-2026-1557","Info":{"Name":"WP Responsive Images \u003c= 1.0 - Arbitrary File Read","Severity":"high","Description":"WP Responsive Images plugin for WordPress \u003c= 1.0 contains a path traversal caused by improper sanitization of the 'src' parameter, letting unauthenticated attackers read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-1557.yaml"}
@@ -3869,32 +3920,43 @@
{"ID":"CVE-2026-20079","Info":{"Name":"Cisco Secure Firewall Management Center - Authentication Bypass","Severity":"critical","Description":"Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-20079.yaml"}
{"ID":"CVE-2026-2025","Info":{"Name":"Mail Mint \u003c 1.19.5 - Unauthenticated Email Disclosure","Severity":"high","Description":"Mail Mint WordPress plugin \u003c 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2025.yaml"}
{"ID":"CVE-2026-21445","Info":{"Name":"Langflow - Broken Access Control","Severity":"critical","Description":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-21445.yaml"}
{"ID":"CVE-2026-21484","Info":{"Name":"AnythingLLM - Username Enumeration via Password Recovery","Severity":"medium","Description":"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-21484.yaml"}
{"ID":"CVE-2026-21643","Info":{"Name":"Fortinet FortiClientEMS 7.4.4 - SQL Injection","Severity":"critical","Description":"Fortinet FortiClientEMS version 7.4.4 and earlier contains an unauthenticated SQL injection vulnerability in the /api/v1/init_consts endpoint. The 'Site' HTTP header value is passed directly into the PostgreSQL search_path without sanitization, allowing remote unauthenticated attackers to inject arbitrary SQL commands. This can lead to information disclosure, database manipulation, or OS command execution when chained with PostgreSQL functions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-21643.yaml"}
{"ID":"CVE-2026-21858","Info":{"Name":"n8n Webhooks - Remote Code Execution","Severity":"critical","Description":"n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-21858.yaml"}
{"ID":"CVE-2026-21859","Info":{"Name":"Mailpit \u003c 1.28.3 - Server-Side Request Forgery","Severity":"high","Description":"Mailpit \u003c= 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-21859.yaml"}
{"ID":"CVE-2026-21877","Info":{"Name":"n8n \u003e= 0.123.0 and \u003c 1.121.3 - Remote Code Execution","Severity":"critical","Description":"n8n versions \u003e= 0.123.0 and \u003c 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leading to full system compromise. The vulnerability affects both self-hosted and n8n Cloud instances.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-21877.yaml"}
{"ID":"CVE-2026-21891","Info":{"Name":"ZimaOS - Authentication Bypass","Severity":"critical","Description":"ZimaOS \u003c= 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-21891.yaml"}
{"ID":"CVE-2026-22200","Info":{"Name":"osTicket - Arbitrary File Read","Severity":"high","Description":"Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-22200.yaml"}
{"ID":"CVE-2026-2262","Info":{"Name":"Easy Appointments \u003c= 3.12.21 - Information Disclosure","Severity":"high","Description":"Easy Appointments WordPress plugin \u003c= 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/ea_appointments/ registered with permission_callback allowing unrestricted access, letting unauthenticated attackers extract sensitive customer appointment data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2262.yaml"}
{"ID":"CVE-2026-22739","Info":{"Name":"Spring Cloud Config Server - Path Traversal","Severity":"high","Description":"Spring Cloud 3.1.x \u003c 3.1.13, 4.1.x \u003c 4.1.9, 4.2.x \u003c 4.2.3, 4.3.x \u003c 4.3.2, and 5.0.x \u003c 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-22739.yaml"}
{"ID":"CVE-2026-22812","Info":{"Name":"OpenCode \u003c 1.0.216 - Unauthenticated Remote Code Execution","Severity":"high","Description":"OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability. The application exposes session and shell execution endpoints without proper authentication, allowing remote attackers to create sessions and execute arbitrary shell commands on the underlying server.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-22812.yaml"}
{"ID":"CVE-2026-23482","Info":{"Name":"Blinko \u003c 1.8.4 - Path Traversal","Severity":"high","Description":"Blinko \u003c 1.8.4 contains a path traversal vulnerability caused by lack of permission checks and filtering on the temp/ path in the file server endpoint, letting unauthorized attackers read arbitrary files including backup files with user notes and tokens, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-23482.yaml"}
{"ID":"CVE-2026-23483","Info":{"Name":"Blinko \u003c= 1.8.3 - Path Traversal via /plugins","Severity":"medium","Description":"Blinko \u003c= 1.8.3 contains a path traversal caused by improper path concatenation without verification in the plugin file server endpoint, letting remote attackers access arbitrary files, exploit requires network access.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-23483.yaml"}
{"ID":"CVE-2026-23486","Info":{"Name":"Blinko \u003c= 1.8.3 - User Information Leak","Severity":"low","Description":"Blinko \u003c= 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-23486.yaml"}
{"ID":"CVE-2026-23550","Info":{"Name":"Modular DS - Broken Access Control","Severity":"high","Description":"Modular DS = 2.5.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-23550.yaml"}
{"ID":"CVE-2026-23744","Info":{"Name":"MCPJam Inspector - Remote Code Execution","Severity":"critical","Description":"MCPJam inspector is the local-first development platform for MCP servers. The Latest version 1.4.2 and earlier are vulnerable to a remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-23744.yaml"}
{"ID":"CVE-2026-23760","Info":{"Name":"SmarterTools SmarterMail - Admin Password Reset","Severity":"critical","Description":"Detected a SmartMail admin password reset vulnerability by sending a POST request to the `/api/v1/auth/force-reset-password` endpoint, indicating that administrative password resets could potentially be triggered without proper authorization.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-23760.yaml"}
{"ID":"CVE-2026-24128","Info":{"Name":"XWiki Platform Distribution Flavor Main - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting (XSS) due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in the context of the victim's browser, potentially leading to session hijacking or other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-24128.yaml"}
{"ID":"CVE-2026-2413","Info":{"Name":"Ally – Web Accessibility \u0026 Usability \u003c= 4.0.3 - SQL Injection","Severity":"high","Description":"The Ally – Web Accessibility \u0026 Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2413.yaml"}
{"ID":"CVE-2026-2416","Info":{"Name":"Geo Mashup \u003c= 1.13.17 - SQL Injection","Severity":"high","Description":"Geo Mashup WordPress plugin \u003c= 1.13.17 contains a SQL injection caused by insufficient escaping of the 'sort' parameter, letting unauthenticated attackers extract sensitive database information remotely.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2416.yaml"}
{"ID":"CVE-2026-24423","Info":{"Name":"SmarterMail - Remote Code Execution","Severity":"critical","Description":"SmarterTools SmarterMail \u003c build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-24423.yaml"}
{"ID":"CVE-2026-24477","Info":{"Name":"AnythingLLM - Information Disclosure","Severity":"high","Description":"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-24477.yaml"}
{"ID":"CVE-2026-25512","Info":{"Name":"Group-Office \u003c 26.0.5 - Remote Code Execution","Severity":"critical","Description":"Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-25512.yaml"}
{"ID":"CVE-2026-25545","Info":{"Name":"Astro SSR - Server-Side Request Forgery","Severity":"high","Description":"Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-25545.yaml"}
{"ID":"CVE-2026-25616","Info":{"Name":"Blesta \u003c= 5.13.1 - Cross-Site Scripting","Severity":"medium","Description":"Blesta 3.x through 5.x before 5.13.3 contains an input validation vulnerability caused by mishandling input, letting attackers potentially exploit the system, exploit requires unspecified conditions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-25616.yaml"}
{"ID":"CVE-2026-25892","Info":{"Name":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","Severity":"high","Description":"Adminer \u003c= 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-25892.yaml"}
{"ID":"CVE-2026-26341","Info":{"Name":"Tattile Camera \u003c 1.181.5 - Default Login","Severity":"high","Description":"Tattile Smart+, Vega, and Basic device families firmware \u003c= 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-26341.yaml"}
{"ID":"CVE-2026-26980","Info":{"Name":"Ghost CMS Content API - SQL Injection","Severity":"critical","Description":"Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-26980.yaml"}
{"ID":"CVE-2026-2699","Info":{"Name":"Progress ShareFile Storage Zones Controller - Authentication Bypass","Severity":"critical","Description":"Customer Managed ShareFile Storage Zones Controller (SZC) contains an authentication bypass (Execution After Redirect) that allows unauthenticated attackers to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-2699.yaml"}
{"ID":"CVE-2026-27174","Info":{"Name":"MajorDoMo - Unauthenticated RCE","Severity":"critical","Description":"MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-27174.yaml"}
{"ID":"CVE-2026-27176","Info":{"Name":"MajorDoMo - Cross-Site Scripting","Severity":"medium","Description":"MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-27176.yaml"}
{"ID":"CVE-2026-27483","Info":{"Name":"MindsDB - Remote Code Execution","Severity":"high","Description":"MindsDB \u003c 25.9.1.1 contains a remote code execution caused by path traversal in the /api/files upload file module, letting authenticated attackers write arbitrary files and execute commands, exploit requires authentication.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-27483.yaml"}
{"ID":"CVE-2026-27645","Info":{"Name":"Changedetection.io RSS Single Watch - Cross-Site Scripting","Severity":"medium","Description":"changedetection.io \u003c 0.54.1 contains a stored XSS caused by unescaped reflection of UUID path parameter in RSS single-watch endpoint, letting remote attackers execute JavaScript in victim's browser, exploit requires victim to visit crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-27645.yaml"}
{"ID":"CVE-2026-27944","Info":{"Name":"Nginx UI \u003c 2.3.3 - Information Disclosure","Severity":"critical","Description":"Nginx UI \u003c 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-27944.yaml"}
{"ID":"CVE-2026-27971","Info":{"Name":"Qwik - Unauthenticated RCE via server$ Deserialization","Severity":"critical","Description":"Qwik \u003c=1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require() availability at runtime.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-27971.yaml"}
{"ID":"CVE-2026-28288","Info":{"Name":"Dify User Enumeration via Observable Response Discrepancy","Severity":"medium","Description":"Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-28288.yaml"}
{"ID":"CVE-2026-28358","Info":{"Name":"NocoDB - User Enumeration","Severity":"medium","Description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-28358.yaml"}
{"ID":"CVE-2026-28409","Info":{"Name":"WeGIA \u003c= 3.6.4 - Remote Code Execution","Severity":"critical","Description":"WeGIA \u003c= 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-28409.yaml"}
{"ID":"CVE-2026-28414","Info":{"Name":"Gradio - Absolute Path Traversal","Severity":"high","Description":"Gradio \u003c 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-28414.yaml"}
{"ID":"CVE-2026-29014","Info":{"Name":"MetInfo CMS \u003c= 8.1 - Remote Code Execution","Severity":"critical","Description":"MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-29014.yaml"}
{"ID":"CVE-2026-29066","Info":{"Name":"TinaCMS - Path Traversal","Severity":"medium","Description":"TinaCMS CLI \u003c 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server.\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2026/CVE-2026-29066.yaml"}
@@ -3905,27 +3967,67 @@
{"ID":"CVE-2026-31807","Info":{"Name":"SiYuan \u003c= v3.5.9 - SVG Animate Element XSS","Severity":"medium","Description":"SiYuan \u003c= v3.5.9 contains a reflected XSS caused by insufficient SVG sanitization allowing SVG animation elements to inject executable JavaScript in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute scripts.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-31807.yaml"}
{"ID":"CVE-2026-31809","Info":{"Name":"SiYuan \u003c= v3.5.9 - Cross Site Scripting","Severity":"medium","Description":"SiYuan v3.5.10 contains a reflected XSS caused by improper sanitization of javascript: href attributes allowing ASCII control characters to bypass prefix checks in SVG sanitizer, letting unauthenticated attackers execute JavaScript via /api/icon/getDynamicIcon.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-31809.yaml"}
{"ID":"CVE-2026-31816","Info":{"Name":"Budibase - Authentication Bypass","Severity":"critical","Description":"Budibase \u003c= 3.31.4 contains an authentication bypass caused by unanchored regex in authorized() middleware matching webhook path patterns in query strings, letting unauthenticated remote attackers access any server-side API endpoint, exploit requires crafted request with webhook pattern in URL.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-31816.yaml"}
{"ID":"CVE-2026-32230","Info":{"Name":"Uptime-Kuma \u003c v1.23.0 - Improper Access Control","Severity":"medium","Description":"Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing access to the protected status page. This can lead to unintended exposure of internal monitoring data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-32230.yaml"}
{"ID":"CVE-2026-32583","Info":{"Name":"Webnus Inc. Modern Events Calendar - Broken Access Control","Severity":"medium","Description":"Webnus Inc. Modern Events Calendar \u003c= 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-32583.yaml"}
{"ID":"CVE-2026-32596","Info":{"Name":"Glances - Information Disclosure","Severity":"high","Description":"Glances \u003c 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-32596.yaml"}
{"ID":"CVE-2026-33017","Info":{"Name":"Langflow \u003c 1.9.0 - Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.9.0 are vulnerable to unauthenticated remote code execution (RCE) via the build_public_tmp endpoint. Attackers can submit a manipulated flow JSON containing Python code that is executed during the build process without proper sandboxing.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33017.yaml"}
{"ID":"CVE-2026-33032","Info":{"Name":"Nginx UI - Broken Access Control","Severity":"critical","Description":"Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33032.yaml"}
{"ID":"CVE-2026-33057","Info":{"Name":"Mesop AI Sandbox \u003c= 1.2.2 - Remote Code Execution","Severity":"critical","Description":"Mesop \u003c= 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33057.yaml"}
{"ID":"CVE-2026-33340","Info":{"Name":"LoLLMs WEBUI - Server-Side Request Forgery","Severity":"critical","Description":"LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-33340.yaml"}
{"ID":"CVE-2026-33439","Info":{"Name":"OpenAM \u003c= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization","Severity":"critical","Description":"Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. This vulnerability is fixed in 16.0.6.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33439.yaml"}
{"ID":"CVE-2026-33478","Info":{"Name":"AVideo \u003c= 26.0 - WWBN AVideo - Remote Code Execution","Severity":"critical","Description":"WWBN AVideo \u003c= 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-33478.yaml"}
{"ID":"CVE-2026-33534","Info":{"Name":"EspoCRM \u003c= 9.3.3 - Server-Side Request Forgery","Severity":"medium","Description":"EspoCRM \u003c= 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost(), letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-33534.yaml"}
{"ID":"CVE-2026-33626","Info":{"Name":"LMDeploy - Server-Side Request Forgery","Severity":"high","Description":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in the vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or private IP addresses, allowing unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources via the image_url parameter in /v1/chat/completions requests.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-33626.yaml"}
{"ID":"CVE-2026-33868","Info":{"Name":"Mastodon - Open Redirect","Severity":"medium","Description":"Mastodon version \u003c 4.5.8, \u003c 4.4.15, \u003c 4.3.21 is vulnerable to unauthenticated Open Redirect vulnerability (CWE-601) exists in the /web/* route due to improper handling of URL-encoded path segments.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-33868.yaml"}
{"ID":"CVE-2026-3396","Info":{"Name":"WCAPF WooCommerce Ajax Product Filter - SQL Injection","Severity":"high","Description":"WCAPF WooCommerce Ajax Product Filter \u003c= 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-3396.yaml"}
{"ID":"CVE-2026-34156","Info":{"Name":"NocoBase - VM Sandbox Escape to Remote Code Execution","Severity":"critical","Description":"NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOW_SCRIPT_MODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain (console._stdout.constructor.constructor to Function to process to child_process) to escape the sandbox and achieve Remote Code Execution as root.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34156.yaml"}
{"ID":"CVE-2026-34197","Info":{"Name":"Apache ActiveMQ - Remote Code Execution","Severity":"critical","Description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: . Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-34197.yaml"}
{"ID":"CVE-2026-34453","Info":{"Name":"SiYuan \u003c= v3.6.1 - Bookmark Data Disclosure","Severity":"high","Description":"SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-34453.yaml"}
{"ID":"CVE-2026-34486","Info":{"Name":"Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution","Severity":"critical","Description":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-34486.yaml"}
{"ID":"CVE-2026-34605","Info":{"Name":"SiYuan Note - Cross-Site Scripting","Severity":"medium","Description":"SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting (XSS) in the `/api/icon/getDynamicIcon` endpoint due to improper filtering of SVG elements with a namespace prefix (such as `\u003cx:script\u003e`). By using a namespaced script element, attackers can bypass the `SanitizeSVG` function and execute arbitrary JavaScript in the victim’s browser upon visiting a crafted link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-34605.yaml"}
{"ID":"CVE-2026-34847","Info":{"Name":"Hoppscotch \u003c= 2026.2.1 - Open Redirect","Severity":"medium","Description":"Hoppscotch \u003c= 2026.2.1 is vulnerable to a DOM-based open redirect on the /enter page. The redirect query parameter is passed directly to windowz location.href with no origin validation. Requires one additional query parameter to trigger. Exploited via a crafted URL such as /enter?redirect=evil.com\u0026foo=bar.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2026/CVE-2026-34847.yaml"}
{"ID":"CVE-2026-34885","Info":{"Name":"WordPress Media Library Assistant \u003c= 3.34 - SQL Injection","Severity":"high","Description":"David Lingren Media Library Assistant \u003c= 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2026/CVE-2026-34885.yaml"}
{"ID":"CVE-2026-35029","Info":{"Name":"LiteLLM - Arbitrary File Read","Severity":"high","Description":"LiteLLM \u003c 1.83.0 contains a broken access control vulnerability caused by lack of admin role enforcement on /config/update endpoint, letting authenticated users modify configurations, execute code, read files, and take over accounts.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-35029.yaml"}
{"ID":"CVE-2026-35616","Info":{"Name":"FortiClient EMS - Authentication Bypass","Severity":"high","Description":"Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-35616.yaml"}
{"ID":"CVE-2026-3584","Info":{"Name":"WordPress Kali Forms \u003c= 2.4.9 - Remote Code Execution","Severity":"critical","Description":"Kali Forms WordPress plugin \u003c= 2.4.9 contains a remote code execution caused by unsafe user input handling in 'form_process' and 'prepare_post_data' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-3584.yaml"}
{"ID":"CVE-2026-38360","Info":{"Name":"dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal","Severity":"critical","Description":"fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dash_uploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-38360.yaml"}
{"ID":"CVE-2026-38361","Info":{"Name":"dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks","Severity":"high","Description":"fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and max_file_size parameter in dash_uploader components, letting remote attackers execute arbitrary code, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-38361.yaml"}
{"ID":"CVE-2026-39339","Info":{"Name":"ChurchCRM - API Authentication Bypass via URL Injection","Severity":"critical","Description":"ChurchCRM \u003c 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-39339.yaml"}
{"ID":"CVE-2026-39352","Info":{"Name":"Frappe Framework \u003c 16.15.0 - Arbitrary File Read via render_include Path Traversal","Severity":"medium","Description":"Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-39352.yaml"}
{"ID":"CVE-2026-39364","Info":{"Name":"Vite Dev Server - Directory Traversal","Severity":"high","Description":"Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a path containing dot segments (e.g., /.vite/../\u003cfilename\u003e) to bypass static file restrictions and access arbitrary files on the filesystem under the project root. The vulnerability allows access to files normally denied by Vite’s \"server.fs.deny\" setting, including sensitive files like .env, configuration files, or credentials in the project root. This issue has been fixed in versions 6.4.3, 6.3.4, and 5.4.23.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-39364.yaml"}
{"ID":"CVE-2026-39365","Info":{"Name":"Vite Dev Server - Path Traversal in Optimized Deps .map Handling","Severity":"medium","Description":"Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments in the URL. This allows an attacker to bypass server.fs.strict and retrieve auto-generated sourcemaps for files located outside the project root, leaking absolute filesystem paths. Only dev servers explicitly exposed to the network using --host or server.host are affected.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-39365.yaml"}
{"ID":"CVE-2026-39808","Info":{"Name":"Fortinet FortiSandbox - Command Injection","Severity":"critical","Description":"Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-39808.yaml"}
{"ID":"CVE-2026-40105","Info":{"Name":"XWiki - Cross-Site Scripting","Severity":"medium","Description":"XWiki is vulnerable to reflected Cross-Site Scripting (XSS) via the `viewer=changes` endpoint. The `rev2` parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-40105.yaml"}
{"ID":"CVE-2026-4020","Info":{"Name":"Gravity SMTP WordPress Plugin - Sensitive Information Exposure","Severity":"high","Description":"Gravity SMTP WordPress plugin \u003c= 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-4020.yaml"}
{"ID":"CVE-2026-40242","Info":{"Name":"Arcane \u003c= 1.17.2 - Server-Side Request Forgery","Severity":"high","Description":"Arcane \u003c= 1.17.3 contains an unauthenticated server-side request forgery caused by lack of URL scheme and host validation in /api/templates/fetch endpoint, letting remote attackers perform SSRF, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-40242.yaml"}
{"ID":"CVE-2026-40308","Info":{"Name":"My Calendar WordPress Plugin - Information Disclosure","Severity":"high","Description":"My Calendar WordPress plugin \u003c= 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parse_str() in mc_ajax_mcjs_action endpoint, letting unauthenticated attackers access or crash sites via switch_to_blog(), exploit requires WordPress Multisite or Single Site setup.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-40308.yaml"}
{"ID":"CVE-2026-40466","Info":{"Name":"Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass","Severity":"high","Description":"Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the \"vm://\" transport scheme in BrokerView.addNetworkConnector() and BrokerView.addConnector() to prevent authenticated attackers from loading malicious Spring XML configurations via the Jolokia API. However, the fix only denied the \"vm\" scheme. An attacker can bypass this restriction by using the HTTP Discovery transport(http://attacker/discovery), which is not in the denied scheme list. The attacker-controlled HTTP endpoint returns a vm:// transport URI as a second-stage response, which then loads a remote Spring XML application context, leading to arbitrary code execution on the broker JVM. The activemq-http module must be on the classpath (present by default in the \"all\" distribution), and authenticated access to the Jolokia API (/api/jolokia/) is required.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-40466.yaml"}
{"ID":"CVE-2026-40878","Info":{"Name":"Mailcow \u003c 2026-03b - Href Link Injection","Severity":"low","Description":"mailcow \u003c 2026-03b reflects raw REQUEST_URI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing.\n","Classification":{"CVSSScore":"3.1"}},"file_path":"http/cves/2026/CVE-2026-40878.yaml"}
{"ID":"CVE-2026-40887","Info":{"Name":"Vendure Core - SQL Injection","Severity":"critical","Description":"Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or input validation, allowing unauthenticated attackers to execute arbitrary SQL commands. This can lead to full database disclosure and denial of service.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-40887.yaml"}
{"ID":"CVE-2026-4106","Info":{"Name":"HT Mega \u003c 3.0.7 - Sensitive Information Disclosure","Severity":"high","Description":"The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-4106.yaml"}
{"ID":"CVE-2026-41176","Info":{"Name":"Rclone RC - Broken Access Control","Severity":"critical","Description":"Rclone \u003e= 1.45.0 and \u003c 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint `options/set` allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires RC server started without global HTTP authentication.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-41176.yaml"}
{"ID":"CVE-2026-41179","Info":{"Name":"RClone RC - Command Injection","Severity":"critical","Description":"Rclone \u003e= 1.48.0 and \u003c 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment without global HTTP authentication.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-41179.yaml"}
{"ID":"CVE-2026-41640","Info":{"Name":"NocoBase - SQL Injection","Severity":"high","Description":"NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without parameterization. An authenticated attacker with record creation permissions on a tree collection with string-type primary keys can inject arbitrary SQL via crafted record identifiers, enabling full database compromise including data exfiltration and modification.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-41640.yaml"}
{"ID":"CVE-2026-41641","Info":{"Name":"NocoBase - SQL Injection","Severity":"high","Description":"NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL() function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-41641.yaml"}
{"ID":"CVE-2026-41940","Info":{"Name":"cPanel \u0026 WHM - Authentication Bypass via Session-File CRLF Injection","Severity":"critical","Description":"cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-41940.yaml"}
{"ID":"CVE-2026-42031","Info":{"Name":"CKAN DataStore SQL Search - SQL Injection","Severity":"high","Description":"CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastore_search_sql API endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-42031.yaml"}
{"ID":"CVE-2026-42281","Info":{"Name":"MagicMirror \u003c= 2.35.0 - Server-Side Request Forgery","Severity":"critical","Description":"An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (VAR_NAME), enabling exfiltration of server-side secrets.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-42281.yaml"}
{"ID":"CVE-2026-42569","Info":{"Name":"phpVMS \u003c 7.0.6 - Legacy Importer Authorization Bypass","Severity":"critical","Description":"phpVMS \u003c 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-42569.yaml"}
{"ID":"CVE-2026-4257","Info":{"Name":"WordPress Contact Form by Supsystic - Server-Side Template Injection","Severity":"critical","Description":"Contact Form by Supsystic WordPress plugin \u003c= 1.7.36 contains a server-side template injection caused by unsandboxed Twig_Loader_String and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-4257.yaml"}
{"ID":"CVE-2026-4631","Info":{"Name":"Cockpit Web Console \u003c 360 - Remote Code Execution","Severity":"critical","Description":"Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-4631.yaml"}
{"ID":"CVE-2026-46372","Info":{"Name":"SillyTavern - Server-Side Request Forgery","Severity":"high","Description":"SillyTavern versions up to and including 1.17.0 expose the /api/search/searxng endpoint, which accepts an attacker-controlled baseUrl parameter and uses it directly to build outbound server-side fetch requests. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the full response body, enabling read access to internal services, cloud metadata endpoints, and private network resources.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2026/CVE-2026-46372.yaml"}
{"ID":"CVE-2026-46670","Info":{"Name":"YesWiki \u003c 4.6.4 - Unauthenticated SQL Injection","Severity":"critical","Description":"YesWiki before version 4.6.4 contains an unauthenticated SQL injection vulnerability in the Bazar form-import path. The bn_id_nature parameter in FormManager::create() is concatenated into an INSERT statement without sanitization, allowing unauthenticated attackers to inject arbitrary SQL and read the full database including password hashes.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-46670.yaml"}
{"ID":"CVE-2026-46725","Info":{"Name":"TYPO3 ceselector Extension - Insecure Deserialization","Severity":"critical","Description":"TYPO3 extension contains a PHP Object Injection caused by passing attacker-controlled cookie to unserialize() without validation, letting remote unauthenticated attackers achieve remote code execution, exploit requires Persistent Mode: Static configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-46725.yaml"}
{"ID":"CVE-2026-47668","Info":{"Name":"DbGate - Remote Code Execution via Anonymous JWT","Severity":"critical","Description":"DbGate contains a remote code execution vulnerability exploitable by unauthenticated attackers. The /auth/login endpoint issues anonymous JWT tokens without credentials, and the /runners/start endpoint accepts JavaScript payloads that execute via Node.js child_process, allowing arbitrary command execution on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-47668.yaml"}
{"ID":"CVE-2026-4810","Info":{"Name":"Google ADK-Python - Unauthenticated Builder Endpoint","Severity":"critical","Description":"Google Agent Development Kit (ADK) 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python (OSS), Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-4810.yaml"}
{"ID":"CVE-2026-5615","Info":{"Name":"VvvebJs \u003c= 2.0.5 - Cross-Site Scripting","Severity":"medium","Description":"Givanz Vvvebjs \u003c= 2.0.5 contains a stored XSS caused by manipulation of the \"uploadAllowExtensions\" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-5615.yaml"}
{"ID":"CVE-2026-5718","Info":{"Name":"Drag and Drop Multiple File Upload - CF7 \u003c= 1.3.9.6 - Remote Code Execution","Severity":"critical","Description":"Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin \u003c= 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-5718.yaml"}
{"ID":"CVE-2026-6118","Info":{"Name":"AstrBot \u003c= 4.22.1 - Command Injection","Severity":"high","Description":"AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any validation or allowlist enforcement. An attacker with dashboard access can execute arbitrary system commands with AstrBot process privileges.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-6118.yaml"}
{"ID":"CVE-2026-6203","Info":{"Name":"User Registration \u0026 Membership WordPress plugin - Open Redirect","Severity":"medium","Description":"User Registration \u0026 Membership WordPress plugin \u003c= 5.1.4 contains an open redirect caused by insufficient validation of 'redirect_to_on_logout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-6203.yaml"}
{"ID":"CVE-2026-6433","Info":{"Name":"FlipperCode Custom CSS, JS \u0026 PHP \u003c= 2.0.7 - Remote Code Execution","Severity":"critical","Description":"Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-6433.yaml"}
{"ID":"CVE-2026-8679","Info":{"Name":"WordPress AudioIgniter \u003c= 2.0.2 - Unauthenticated IDOR","Severity":"high","Description":"The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-8679.yaml"}
{"ID":"CVE-2026-9082","Info":{"Name":"Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query","Severity":"critical","Description":"Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9082.yaml"}
{"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
{"ID":"CVE-2004-0437","Info":{"Name":"Titan FTP Server 3.01 - DoS via LIST Command Disconnection","Severity":"medium","Description":"Titan FTP Server version 3.01 build 163 (and possibly other older versions) contains a vulnerability where disconnecting during a LIST -L command may crash the daemon. Remote attackers can cause denial of service by initiating a LIST -L command and then abruptly disconnecting, leading to server instability.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0437.yaml"}
{"ID":"CVE-2004-0656","Info":{"Name":"Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion","Severity":"medium","Description":"Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0656.yaml"}
@@ -3984,6 +4086,7 @@
{"ID":"CVE-2025-47188","Info":{"Name":"Mitel 6000 - OS Command Injection","Severity":"critical","Description":"A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. This template should be run on port 49249/tcp.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"network/cves/2025/CVE-2025-47188.yaml"}
{"ID":"CVE-2025-8286","Info":{"Name":"Güralp Systems FMUS Series - Unauthenticated Access","Severity":"critical","Description":"Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-8286.yaml"}
{"ID":"CVE-2026-23829","Info":{"Name":"Mailpit \u003c 1.28.2 - SMTP CRLF Injection","Severity":"medium","Description":"Mailpit \u003c 1.28 contains a header injection caused by insufficient regex validation of `RCPT TO` and `MAIL FROM` addresses in the SMTP server, letting attackers inject arbitrary SMTP headers, exploit requires crafted email addresses\n","Classification":{"CVSSScore":"5.3"}},"file_path":"network/cves/2026/CVE-2026-23829.yaml"}
{"ID":"CVE-2026-42167","Info":{"Name":"ProFTPD mod_sql - Preauth User Backdoor","Severity":"high","Description":"ProFTPD mod_sql before 1.3.10rc1 contains a remote code execution caused by unsafe username handling with SQL backend commands in USER request logging expansions, letting remote attackers execute arbitrary code, exploit requires SQL backend allowing commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2026/CVE-2026-42167.yaml"}
{"ID":"CVE-2010-20103","Info":{"Name":"ProFTPd-1.3.3c - Backdoor Command Execution","Severity":"critical","Description":"ProFTPD 1.3.3c contains a command injection backdoor caused by a hidden FTP command trigger in the source tarball, letting remote unauthenticated attackers execute arbitrary shell commands with root privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2010/CVE-2010-20103.yaml"}
{"ID":"CVE-2012-2122","Info":{"Name":"MySQL - Authentication Bypass","Severity":"medium","Description":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.\n","Classification":{"CVSSScore":"5.1"}},"file_path":"javascript/cves/2012/CVE-2012-2122.yaml"}
{"ID":"CVE-2016-8706","Info":{"Name":"Memcached Server SASL Authentication - Remote Code Execution","Severity":"high","Description":"An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"javascript/cves/2016/CVE-2016-8706.yaml"}
@@ -4012,4 +4115,7 @@
{"ID":"CVE-2025-46819","Info":{"Name":"Redis \u003c 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46819.yaml"}
{"ID":"CVE-2025-49844","Info":{"Name":"Redis Lua Parser \u003c 8.2.2 - Use After Free","Severity":"critical","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-49844.yaml"}
{"ID":"CVE-2026-1731","Info":{"Name":"BeyondTrust Remote Support - Unauthenticated WebSocket RCE","Severity":"critical","Description":"BeyondTrust Remote Support is vulnerable to unauthenticated remote code execution via the WebSocket endpoint /nw. An attacker can extract the company identifier from the /get_mech_list endpoint and use it to connect to the WebSocket service, then inject OS commands through the binary WebSocket payload that are executed on the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2026/CVE-2026-1731.yaml"}
{"ID":"CVE-2026-33453","Info":{"Name":"Apache Camel camel-coap - Remote Code Execution","Severity":"critical","Description":"Apache Camel camel-coap component 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0 contains a remote code execution caused by improper header filtering of CoAP URI query parameters, letting unauthenticated attackers inject headers and execute arbitrary OS commands via header-sensitive producers, exploit requires sending a single CoAP UDP packet.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"javascript/cves/2026/CVE-2026-33453.yaml"}
{"ID":"CVE-2026-39363","Info":{"Name":"Vite Dev Server - Arbitrary File Read","Severity":"high","Description":"Vite dev server exposes the fetchModule method via its WebSocket HMR (Hot Module Replacement) endpoint using the vite-hmr sub-protocol. By connecting to the WebSocket endpoint and sending a crafted vite:invoke custom event that calls fetchModule with a file:// URL (e.g., file:///etc/passwd?raw), an attacker can bypass server.fs.deny restrictions and read arbitrary files from the server filesystem. The vulnerability exists because fetchModule does not enforce the same filesystem access controls as other Vite server endpoints.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"javascript/cves/2026/CVE-2026-39363.yaml"}
{"ID":"CVE-2026-39987","Info":{"Name":"Marimo \u003c= 0.20.4 - Pre-Auth Terminal WebSocket RCE","Severity":"critical","Description":"Marimo versions \u003c= 0.20.4 contain an unauthenticated remote code execution vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to connect via WebSocket, obtain a full PTY shell, and execute arbitrary OS commands on the underlying server.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"javascript/cves/2026/CVE-2026-39987.yaml"}
{"ID":"CVE-2026-44578","Info":{"Name":"Next.js WebSocket Upgrade Handler - SSRF","Severity":"high","Description":"Next.js 13.4.13 to before 15.5.16 and 16.2.5 contains a server-side request forgery caused by crafted WebSocket upgrade requests in the built-in Node.js server, letting attackers proxy requests to arbitrary destinations, exploit requires self-hosted deployment.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"javascript/cves/2026/CVE-2026-44578.yaml"}
The Android application requests the REQUEST_INSTALL_PACKAGES permission, which allows the app to request installation of packages from unknown sources. This permission may increase the risk of unauthorized APK installation or abuse.
Loaded 100 of 4273 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
ghost