diff --git a/2007/CVE-2007-2896.md b/2007/CVE-2007-2896.md index 47945accb6..f88b7b823c 100644 --- a/2007/CVE-2007-2896.md +++ b/2007/CVE-2007-2896.md @@ -10,6 +10,7 @@ Race condition in the Symantec Enterprise Security Manager (ESM) 6.5.3 managers ### POC #### Reference +- http://securityresponse.symantec.com/avcenter/security/Content/2007.05.24b.html - http://www.vupen.com/english/advisories/2007/1940 #### Github diff --git a/2008/CVE-2008-0485.md b/2008/CVE-2008-0485.md index 425b1b4ef4..318442f0b3 100644 --- a/2008/CVE-2008-0485.md +++ b/2008/CVE-2008-0485.md @@ -11,6 +11,7 @@ Array index error in libmpdemux/demux_mov.c in MPlayer 1.0 rc2 and earlier might #### Reference - http://securityreason.com/securityalert/3607 +- http://www.coresecurity.com/?action=item&id=2102 #### Github No PoCs found on GitHub currently. diff --git a/2013/CVE-2013-2417.md b/2013/CVE-2013-2417.md index 36de5f6c8b..9b9ab78b60 100644 --- a/2013/CVE-2013-2417.md +++ b/2013/CVE-2013-2417.md @@ -12,6 +12,7 @@ Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora #### Reference - http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html - http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html +- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19570 #### Github - https://github.com/PalindromeLabs/Java-Deserialization-CVEs diff --git a/2020/CVE-2020-35833.md b/2020/CVE-2020-35833.md new file mode 100644 index 0000000000..f73268a17d --- /dev/null +++ b/2020/CVE-2020-35833.md @@ -0,0 +1,17 @@ +### [CVE-2020-35833](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35833) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBK20 before 2.3.5.26, RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK40 before 2.3.5.30, RBR40 before 2.3.5.30, RBS40 before 2.3.5.30, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, XR500 before 2.3.2.56, and XR700 before 1.0.1.10. + +### POC + +#### Reference +- https://kb.netgear.com/000062677/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-WiFi-Systems-PSV-2018-0512 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2022/CVE-2022-4995.md b/2022/CVE-2022-4995.md new file mode 100644 index 0000000000..2fd5715854 --- /dev/null +++ b/2022/CVE-2022-4995.md @@ -0,0 +1,18 @@ +### [CVE-2022-4995](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4995) +![](https://img.shields.io/static/v1?label=Product&message=E-cology%209.0&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen) + +### Description + +Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary secId and plandetailid field values. Successful exploitation results in remote code execution under the privileges of the application server process. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14 (UTC). + +### POC + +#### Reference +- https://www.vulncheck.com/advisories/weaver-e-cology-file-upload-rce-via-uploaderoperate-jsp +- https://www.weaver.com.cn/cs/ecology_full_log_en.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-15597.md b/2025/CVE-2025-15597.md index d9abd15e25..4e40336c7c 100644 --- a/2025/CVE-2025-15597.md +++ b/2025/CVE-2025-15597.md @@ -17,6 +17,7 @@ A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an u #### Reference - https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r +- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md - https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md #### Github diff --git a/2025/CVE-2025-15623.md b/2025/CVE-2025-15623.md new file mode 100644 index 0000000000..8a443341f9 --- /dev/null +++ b/2025/CVE-2025-15623.md @@ -0,0 +1,18 @@ +### [CVE-2025-15623](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15623) +![](https://img.shields.io/static/v1?label=Product&message=Sparx%20Pro%20Cloud%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=6.0.163%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-359%3A%20Exposure%20of%20Private%20Personal%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-497%3A%20Exposure%20of%20Sensitive%20System%20Information%20to%20an%20Unauthorized%20Control%20Sphere&color=brightgreen) + +### Description + +Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.Unauthenticated user can retrieve database password in plaintext in certain situations + +### POC + +#### Reference +- https://sparxsystems.com/products/procloudserver/6.1/history.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-15624.md b/2025/CVE-2025-15624.md new file mode 100644 index 0000000000..faf54170d6 --- /dev/null +++ b/2025/CVE-2025-15624.md @@ -0,0 +1,17 @@ +### [CVE-2025-15624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15624) +![](https://img.shields.io/static/v1?label=Product&message=Sparx%20Pro%20Cloud%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=6.0.163%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-256%3A%20Plaintext%20Storage%20of%20a%20Password&color=brightgreen) + +### Description + +Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext. + +### POC + +#### Reference +- https://sparxsystems.com/products/procloudserver/6.1/history.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-15625.md b/2025/CVE-2025-15625.md new file mode 100644 index 0000000000..1cac4c55fa --- /dev/null +++ b/2025/CVE-2025-15625.md @@ -0,0 +1,18 @@ +### [CVE-2025-15625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15625) +![](https://img.shields.io/static/v1?label=Product&message=Sparx%20Pro%20Cloud%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=6.0.163%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases. + +### POC + +#### Reference +- https://sparxsystems.com/products/procloudserver/6.1/history.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-15667.md b/2025/CVE-2025-15667.md new file mode 100644 index 0000000000..4c9779e68c --- /dev/null +++ b/2025/CVE-2025-15667.md @@ -0,0 +1,18 @@ +### [CVE-2025-15667](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15667) +![](https://img.shields.io/static/v1?label=Product&message=GPAC&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.5-DEV%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Double%20Free&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of the component MP4Box. This manipulation of the argument nalu_out_bs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch. + +### POC + +#### Reference +- https://github.com/gpac/gpac/issues/3403 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-4375.md b/2025/CVE-2025-4375.md new file mode 100644 index 0000000000..5e5e982bdb --- /dev/null +++ b/2025/CVE-2025-4375.md @@ -0,0 +1,18 @@ +### [CVE-2025-4375](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4375) +![](https://img.shields.io/static/v1?label=Product&message=Pro%20Cloud%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. This issue affects Pro Cloud Server: earlier than 6.0.165. + +### POC + +#### Reference +- https://sparxsystems.com/products/procloudserver/6.1/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-4376.md b/2025/CVE-2025-4376.md new file mode 100644 index 0000000000..14d3120d9f --- /dev/null +++ b/2025/CVE-2025-4376.md @@ -0,0 +1,18 @@ +### [CVE-2025-4376](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4376) +![](https://img.shields.io/static/v1?label=Product&message=Pro%20Cloud%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%20Improper%20Input%20Validation&color=brightgreen) + +### Description + +Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). This issue affects Pro Cloud Server: earlier than 6.0.165. + +### POC + +#### Reference +- https://sparxsystems.com/products/procloudserver/6.1/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-4377.md b/2025/CVE-2025-4377.md new file mode 100644 index 0000000000..c1c72cf1f1 --- /dev/null +++ b/2025/CVE-2025-4377.md @@ -0,0 +1,19 @@ +### [CVE-2025-4377](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4377) +![](https://img.shields.io/static/v1?label=Product&message=Pro%20Cloud%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pro Cloud Server: earlier than 6.0.165. + +### POC + +#### Reference +- https://sparxsystems.com/products/procloudserver/6.1/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-50455.md b/2025/CVE-2025-50455.md new file mode 100644 index 0000000000..ad8fe7f60e --- /dev/null +++ b/2025/CVE-2025-50455.md @@ -0,0 +1,18 @@ +### [CVE-2025-50455](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50455) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE. + +### POC + +#### Reference +- https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/advisory.md +- https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/poc.py + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-53000.md b/2025/CVE-2025-53000.md new file mode 100644 index 0000000000..183334001d --- /dev/null +++ b/2025/CVE-2025-53000.md @@ -0,0 +1,17 @@ +### [CVE-2025-53000](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53000) +![](https://img.shields.io/static/v1?label=Product&message=nbconvert&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%207.17.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-427%3A%20Uncontrolled%20Search%20Path%20Element&color=brightgreen) + +### Description + +The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0. + +### POC + +#### Reference +- https://www.imperva.com/blog/code-execution-in-jupyter-notebook-exports + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-57538.md b/2025/CVE-2025-57538.md index c19d5ae305..502dada7f3 100644 --- a/2025/CVE-2025-57538.md +++ b/2025/CVE-2025-57538.md @@ -11,6 +11,7 @@ A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within #### Reference - https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss +- https://www.youtube.com/watch?v=mN-0Zia1LZw #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-6020.md b/2025/CVE-2025-6020.md index 84b656729d..feb448787b 100644 --- a/2025/CVE-2025-6020.md +++ b/2025/CVE-2025-6020.md @@ -19,7 +19,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Update%20Services%20for%20SAP%20Solutions&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.4%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Insights%20proxy%201.5&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.6.1&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.6.0&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20sandboxed%20containers%201.1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Web%20Terminal%201.11%20on%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Web%20Terminal%201.12%20on%20RHEL%209&color=blue) diff --git a/2025/CVE-2025-65336.md b/2025/CVE-2025-65336.md new file mode 100644 index 0000000000..aaa06be7a1 --- /dev/null +++ b/2025/CVE-2025-65336.md @@ -0,0 +1,17 @@ +### [CVE-2025-65336](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65336) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/ecommercefruitsbazarmaster/20250811-ecommerce-project-with-php-and-mysqli-fruits-bazar-show_price_by_pdtid.php-pid-sqli/20250811-ecommerce-project-with-php-and-mysqli-fruits-bazar-show_price_by_pdtid.php-pid-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-65337.md b/2025/CVE-2025-65337.md new file mode 100644 index 0000000000..fe2e1f2a88 --- /dev/null +++ b/2025/CVE-2025-65337.md @@ -0,0 +1,17 @@ +### [CVE-2025-65337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65337) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/fantasticblog/XSS1.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-65340.md b/2025/CVE-2025-65340.md new file mode 100644 index 0000000000..2213e3f13a --- /dev/null +++ b/2025/CVE-2025-65340.md @@ -0,0 +1,17 @@ +### [CVE-2025-65340](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65340) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-betweendates-detailsreports.php-fromdate-sqli/20250811-hospital-management-system-betweendates-detailsreports.php-fromdate-sqli.md#injection-techniques-as-identified-by-sqlmap + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-65341.md b/2025/CVE-2025-65341.md new file mode 100644 index 0000000000..5b67263243 --- /dev/null +++ b/2025/CVE-2025-65341.md @@ -0,0 +1,17 @@ +### [CVE-2025-65341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65341) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/ecommercefruitsbazar/XSS.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-65342.md b/2025/CVE-2025-65342.md new file mode 100644 index 0000000000..0e54416cd3 --- /dev/null +++ b/2025/CVE-2025-65342.md @@ -0,0 +1,17 @@ +### [CVE-2025-65342](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65342) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/bloodsystem/XSS1.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-67403.md b/2025/CVE-2025-67403.md new file mode 100644 index 0000000000..4e9b581cdd --- /dev/null +++ b/2025/CVE-2025-67403.md @@ -0,0 +1,17 @@ +### [CVE-2025-67403](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67403) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_class.php-class_name-sqli/20250811-casap-automated-enrollment-system-update_class.php-class_name-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-67404.md b/2025/CVE-2025-67404.md new file mode 100644 index 0000000000..f3759ed0ab --- /dev/null +++ b/2025/CVE-2025-67404.md @@ -0,0 +1,17 @@ +### [CVE-2025-67404](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67404) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_stud.php-fname-sqli/20250811-casap-automated-enrollment-system-save_stud.php-fname-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-67405.md b/2025/CVE-2025-67405.md new file mode 100644 index 0000000000..da36383197 --- /dev/null +++ b/2025/CVE-2025-67405.md @@ -0,0 +1,17 @@ +### [CVE-2025-67405](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67405) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_password.php-new_password-sqli/20250811-casap-automated-enrollment-system-update_password.php-new_password-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-67406.md b/2025/CVE-2025-67406.md new file mode 100644 index 0000000000..960509a137 --- /dev/null +++ b/2025/CVE-2025-67406.md @@ -0,0 +1,17 @@ +### [CVE-2025-67406](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67406) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: control/activate_case.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activate_case.php in parameter id endpoint of Advocate office management system. Unsanitized user input in the specified parameter is interpolated directly into an SQL query, allowing attackers to infer or extract data and, in some cases, execute stacked/time-based payloads. ¶¶ Affected Component & Parameter Affected Endpoint URL: http://localhost/advocate/kortex_lite/control/activate_case.php?id=1 HTTP Method: GET Vulnerable File: activate_case.php Parameter: id Vector Location: GET Injection Techniques (as identified by sqlmap) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: id=1 AND EXTRACTVALUE(6268,CONCAT(0x5c,0x71766b6a71,(SELECT (ELT(6268=6268,1))),0x716a7a6b71)) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 4464 FROM (SELECT(SLEEP(5)))aHqo) Proof of Concept (Burp Repeater) + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/advocate/20250811-advocate-office-management-system-activate_case.php-id-sqli/20250811-advocate-office-management-system-activate_case.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-67407.md b/2025/CVE-2025-67407.md new file mode 100644 index 0000000000..d16beec91e --- /dev/null +++ b/2025/CVE-2025-67407.md @@ -0,0 +1,17 @@ +### [CVE-2025-67407](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67407) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_student.php-fname-sqli/20250811-casap-automated-enrollment-system-update_student.php-fname-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-67408.md b/2025/CVE-2025-67408.md new file mode 100644 index 0000000000..f266407013 --- /dev/null +++ b/2025/CVE-2025-67408.md @@ -0,0 +1,17 @@ +### [CVE-2025-67408](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67408) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_user.php-status-sqli/20250811-casap-automated-enrollment-system-save_user.php-status-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69205.md b/2025/CVE-2025-69205.md new file mode 100644 index 0000000000..dac2ab39d1 --- /dev/null +++ b/2025/CVE-2025-69205.md @@ -0,0 +1,18 @@ +### [CVE-2025-69205](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69205) +![](https://img.shields.io/static/v1?label=Product&message=uURU&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2088db9a953f38a3026bcd6816d51c7f3b93c55893%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%3A%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brightgreen) + +### Description + +Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the `Dial( )` application due to improper input validation. This allows an attacker to redirect calls on both of the federating instances. If the attack succeeds, the impact is very high. However, the requires that an admin accept the federation requests. As of time of publication, a known patched version of µURU is not available. + +### POC + +#### Reference +- https://github.com/olell/uURU/security/advisories/GHSA-xvrh-pm3f-79v4 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69286.md b/2025/CVE-2025-69286.md new file mode 100644 index 0000000000..a0c00ddf0d --- /dev/null +++ b/2025/CVE-2025-69286.md @@ -0,0 +1,17 @@ +### [CVE-2025-69286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69286) +![](https://img.shields.io/static/v1?label=Product&message=ragflow&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-340%3A%20Generation%20of%20Predictable%20Numbers%20or%20Identifiers&color=brightgreen) + +### Description + +RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue. + +### POC + +#### Reference +- https://github.com/infiniflow/ragflow/security/advisories/GHSA-9j5g-g4xm-57w7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69437.md b/2025/CVE-2025-69437.md new file mode 100644 index 0000000000..cf81f94470 --- /dev/null +++ b/2025/CVE-2025-69437.md @@ -0,0 +1,17 @@ +### [CVE-2025-69437](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69437) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be triggered, resulting in issues such as credential theft, arbitrary API execution, and other security concerns. This vulnerability affects all file upload endpoint, including /cmsTemplate/save, /file/doUpload, /cmsTemplate/doUpload, /file/doBatchUpload, /cmsWebFile/doUpload, etc. + +### POC + +#### Reference +- https://github.com/sanluan/PublicCMS/issues/103 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69770.md b/2025/CVE-2025-69770.md new file mode 100644 index 0000000000..199bbc519b --- /dev/null +++ b/2025/CVE-2025-69770.md @@ -0,0 +1,17 @@ +### [CVE-2025-69770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69770) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file. + +### POC + +#### Reference +- https://github.com/kid-tnt/Mojo-check/blob/main/Zipslip%20in%20MojoPortal%20version%202.9.0.1.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69820.md b/2025/CVE-2025-69820.md new file mode 100644 index 0000000000..c0401cacbd --- /dev/null +++ b/2025/CVE-2025-69820.md @@ -0,0 +1,17 @@ +### [CVE-2025-69820](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69820) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function. + +### POC + +#### Reference +- https://github.com/ryotaromatsui/CVEs/tree/main/CVE-2025-69820 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69871.md b/2025/CVE-2025-69871.md new file mode 100644 index 0000000000..f35f762592 --- /dev/null +++ b/2025/CVE-2025-69871.md @@ -0,0 +1,17 @@ +### [CVE-2025-69871](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69871) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage limits by sending concurrent checkout requests, resulting in unlimited redemptions of limited-use promotional codes and potential financial loss. + +### POC + +#### Reference +- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69871-MedusaJS-TOCTOU.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69874.md b/2025/CVE-2025-69874.md new file mode 100644 index 0000000000..193f93536a --- /dev/null +++ b/2025/CVE-2025-69874.md @@ -0,0 +1,17 @@ +### [CVE-2025-69874](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69874) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence. + +### POC + +#### Reference +- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69874-nanotar-Path-Traversal.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69930.md b/2025/CVE-2025-69930.md new file mode 100644 index 0000000000..d6cfda7cbb --- /dev/null +++ b/2025/CVE-2025-69930.md @@ -0,0 +1,17 @@ +### [CVE-2025-69930](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69930) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-print_membership_card.php-id-sqli/20250811-membership-management-system-print_membership_card.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69931.md b/2025/CVE-2025-69931.md new file mode 100644 index 0000000000..e0900047e0 --- /dev/null +++ b/2025/CVE-2025-69931.md @@ -0,0 +1,17 @@ +### [CVE-2025-69931](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69931) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-delete_membership.php-id-sqli/20250811-membership-management-system-delete_membership.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69933.md b/2025/CVE-2025-69933.md new file mode 100644 index 0000000000..31d724661f --- /dev/null +++ b/2025/CVE-2025-69933.md @@ -0,0 +1,17 @@ +### [CVE-2025-69933](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69933) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-memberprofile.php-id-sqli/20250811-membership-management-system-memberprofile.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69934.md b/2025/CVE-2025-69934.md new file mode 100644 index 0000000000..624e1e8012 --- /dev/null +++ b/2025/CVE-2025-69934.md @@ -0,0 +1,17 @@ +### [CVE-2025-69934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69934) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-delete_members.php-id-sqli/20250811-membership-management-system-delete_members.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69935.md b/2025/CVE-2025-69935.md new file mode 100644 index 0000000000..093f71f768 --- /dev/null +++ b/2025/CVE-2025-69935.md @@ -0,0 +1,17 @@ +### [CVE-2025-69935](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69935) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-revenue_report.php-fromdate-sqli/20250811-membership-management-system-revenue_report.php-fromdate-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69936.md b/2025/CVE-2025-69936.md new file mode 100644 index 0000000000..dbe1a881a3 --- /dev/null +++ b/2025/CVE-2025-69936.md @@ -0,0 +1,17 @@ +### [CVE-2025-69936](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69936) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-edit_member.php-id-sqli/20250811-membership-management-system-edit_member.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69937.md b/2025/CVE-2025-69937.md new file mode 100644 index 0000000000..a96b82297b --- /dev/null +++ b/2025/CVE-2025-69937.md @@ -0,0 +1,17 @@ +### [CVE-2025-69937](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69937) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-edit_type.php-id-sqli/20250811-membership-management-system-edit_type.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69938.md b/2025/CVE-2025-69938.md new file mode 100644 index 0000000000..7f3dfa6bd7 --- /dev/null +++ b/2025/CVE-2025-69938.md @@ -0,0 +1,17 @@ +### [CVE-2025-69938](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69938) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-renew.php-membershiptype-sqli/20250811-membership-management-system-renew.php-membershiptype-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69941.md b/2025/CVE-2025-69941.md new file mode 100644 index 0000000000..64ff44b9b0 --- /dev/null +++ b/2025/CVE-2025-69941.md @@ -0,0 +1,17 @@ +### [CVE-2025-69941](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69941) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/tailor/20250811-tailor-ms-addmeasurement.php-id-sqli/20250811-tailor-ms-addmeasurement.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69942.md b/2025/CVE-2025-69942.md new file mode 100644 index 0000000000..90dba71668 --- /dev/null +++ b/2025/CVE-2025-69942.md @@ -0,0 +1,17 @@ +### [CVE-2025-69942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69942) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-view-patient.php-viewid-sqli/20250811-hospital-management-system-view-patient.php-viewid-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69943.md b/2025/CVE-2025-69943.md new file mode 100644 index 0000000000..e956951c6d --- /dev/null +++ b/2025/CVE-2025-69943.md @@ -0,0 +1,18 @@ +### [CVE-2025-69943](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69943) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-doctor-sqli/20250811-hospital-management-system-get_doctor.php-doctor-sqli.md +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69944.md b/2025/CVE-2025-69944.md new file mode 100644 index 0000000000..2f780d399c --- /dev/null +++ b/2025/CVE-2025-69944.md @@ -0,0 +1,17 @@ +### [CVE-2025-69944](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69944) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-view-medhistory.php-viewid-sqli/20250811-hospital-management-system-view-medhistory.php-viewid-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69945.md b/2025/CVE-2025-69945.md new file mode 100644 index 0000000000..39669b7fbe --- /dev/null +++ b/2025/CVE-2025-69945.md @@ -0,0 +1,17 @@ +### [CVE-2025-69945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69945) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-edit-patient.php-editid-sqli/20250811-hospital-management-system-edit-patient.php-editid-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69946.md b/2025/CVE-2025-69946.md new file mode 100644 index 0000000000..95e0b9f987 --- /dev/null +++ b/2025/CVE-2025-69946.md @@ -0,0 +1,22 @@ +### [CVE-2025-69946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69946) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli.md +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli.md +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli.md +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli.md +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-delete_group.php-id-sqli/20250811-modern-loan-management-system-delete_group.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69947.md b/2025/CVE-2025-69947.md new file mode 100644 index 0000000000..359ef109a7 --- /dev/null +++ b/2025/CVE-2025-69947.md @@ -0,0 +1,17 @@ +### [CVE-2025-69947](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69947) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/tailor/20250811-tailor-ms-customeredit.php-id-sqli/20250811-tailor-ms-customeredit.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69948.md b/2025/CVE-2025-69948.md new file mode 100644 index 0000000000..f1070aef49 --- /dev/null +++ b/2025/CVE-2025-69948.md @@ -0,0 +1,19 @@ +### [CVE-2025-69948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69948) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-emailid-sqli/20250811-hospital-management-system-check_availability.php-emailid-sqli.md +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-delete_group.php-id-sqli/20250811-modern-loan-management-system-delete_group.php-id-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69949.md b/2025/CVE-2025-69949.md new file mode 100644 index 0000000000..9df9bee848 --- /dev/null +++ b/2025/CVE-2025-69949.md @@ -0,0 +1,18 @@ +### [CVE-2025-69949](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69949) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email. + +### POC + +#### Reference +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-email-sqli/20250811-hospital-management-system-check_availability.php-email-sqli.md +- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-emailid-sqli/20250811-hospital-management-system-check_availability.php-emailid-sqli.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69985.md b/2025/CVE-2025-69985.md new file mode 100644 index 0000000000..f1ebb9e9af --- /dev/null +++ b/2025/CVE-2025-69985.md @@ -0,0 +1,17 @@ +### [CVE-2025-69985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69985) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server. + +### POC + +#### Reference +- https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-7195.md b/2025/CVE-2025-7195.md index 1550f79247..9111b92d6d 100644 --- a/2025/CVE-2025-7195.md +++ b/2025/CVE-2025-7195.md @@ -25,7 +25,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=multicluster%20engine%20for%20Kubernetes%202.6&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=multicluster%20engine%20for%20Kubernetes%202.7&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=multicluster%20engine%20for%20Kubernetes%202.8&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=multicluster%20engine%20for%20Kubernetes%202.9&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=multicluster%20engine%20for%20Kubernetes%202.9.0&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=operator-sdk&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) diff --git a/2025/CVE-2025-8546.md b/2025/CVE-2025-8546.md index 166f2c3a98..aa11c569d4 100644 --- a/2025/CVE-2025-8546.md +++ b/2025/CVE-2025-8546.md @@ -15,6 +15,7 @@ Es wurde eine problematische Schwachstelle in atjiu pybbs bis 6.0.0 gefunden. Es - https://github.com/atjiu/pybbs/issues/199 - https://github.com/atjiu/pybbs/issues/199#issue-3256276118 - https://github.com/atjiu/pybbs/issues/199#issuecomment-3134573731 +- https://vuldb.com/?ctiid.318675 #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2026/CVE-2026-12971.md b/2026/CVE-2026-12971.md new file mode 100644 index 0000000000..732534d7ad --- /dev/null +++ b/2026/CVE-2026-12971.md @@ -0,0 +1,17 @@ +### [CVE-2026-12971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12971) +![](https://img.shields.io/static/v1?label=Product&message=LearnPress&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/ef69bd9d-ec2a-4526-b2b9-51948fa76980/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13170.md b/2026/CVE-2026-13170.md new file mode 100644 index 0000000000..ce76062f3d --- /dev/null +++ b/2026/CVE-2026-13170.md @@ -0,0 +1,17 @@ +### [CVE-2026-13170](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13170) +![](https://img.shields.io/static/v1?label=Product&message=Eventin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/c7bdaa80-a446-4c72-be79-bfc5022a4eca/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13600.md b/2026/CVE-2026-13600.md new file mode 100644 index 0000000000..797e1e86c3 --- /dev/null +++ b/2026/CVE-2026-13600.md @@ -0,0 +1,17 @@ +### [CVE-2026-13600](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13600) +![](https://img.shields.io/static/v1?label=Product&message=AutoNetTV%20Relay&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/2f69e28f-cc9f-422e-a014-662f3fddfad3/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13701.md b/2026/CVE-2026-13701.md new file mode 100644 index 0000000000..72253f8f76 --- /dev/null +++ b/2026/CVE-2026-13701.md @@ -0,0 +1,17 @@ +### [CVE-2026-13701](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13701) +![](https://img.shields.io/static/v1?label=Product&message=Advanced%20Excerpt&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/2710686c-055c-460c-8480-573e394f24d8/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14206.md b/2026/CVE-2026-14206.md new file mode 100644 index 0000000000..9bee307257 --- /dev/null +++ b/2026/CVE-2026-14206.md @@ -0,0 +1,17 @@ +### [CVE-2026-14206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14206) +![](https://img.shields.io/static/v1?label=Product&message=HT%20Contact%20Form&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/36ae857c-6812-46e0-a0e7-6c868108ef39/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14211.md b/2026/CVE-2026-14211.md new file mode 100644 index 0000000000..c1f7e4d7cc --- /dev/null +++ b/2026/CVE-2026-14211.md @@ -0,0 +1,17 @@ +### [CVE-2026-14211](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14211) +![](https://img.shields.io/static/v1?label=Product&message=Booking%20for%20Appointments%20and%20Events%20Calendar&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/511d2d53-34c5-4457-bc25-6f9105b57825/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14226.md b/2026/CVE-2026-14226.md index aca6183f6f..d201737b45 100644 --- a/2026/CVE-2026-14226.md +++ b/2026/CVE-2026-14226.md @@ -5,7 +5,7 @@ ### Description -The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses. +The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses. ### POC diff --git a/2026/CVE-2026-14237.md b/2026/CVE-2026-14237.md new file mode 100644 index 0000000000..5eff776e38 --- /dev/null +++ b/2026/CVE-2026-14237.md @@ -0,0 +1,19 @@ +### [CVE-2026-14237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14237) +![](https://img.shields.io/static/v1?label=Product&message=Vitepos&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=vitepos&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%20Improper%20Privilege%20Management&color=brightgreen) + +### Description + +The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/7f1eb6ec-c4fb-4c0d-887d-1812a84e29c0/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14238.md b/2026/CVE-2026-14238.md new file mode 100644 index 0000000000..28874c0e95 --- /dev/null +++ b/2026/CVE-2026-14238.md @@ -0,0 +1,17 @@ +### [CVE-2026-14238](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14238) +![](https://img.shields.io/static/v1?label=Product&message=vitepos&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen) + +### Description + +The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/d526b352-74a4-444c-a251-75468863b444/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14293.md b/2026/CVE-2026-14293.md new file mode 100644 index 0000000000..34b42b461b --- /dev/null +++ b/2026/CVE-2026-14293.md @@ -0,0 +1,17 @@ +### [CVE-2026-14293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14293) +![](https://img.shields.io/static/v1?label=Product&message=Autopay&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/99fa208c-1a6f-4379-847c-388b9cec349e/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14860.md b/2026/CVE-2026-14860.md new file mode 100644 index 0000000000..b04ea73b29 --- /dev/null +++ b/2026/CVE-2026-14860.md @@ -0,0 +1,17 @@ +### [CVE-2026-14860](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14860) +![](https://img.shields.io/static/v1?label=Product&message=Podcast%20Player&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/ea752266-9bff-4c36-91aa-9aca0232c7af/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14941.md b/2026/CVE-2026-14941.md new file mode 100644 index 0000000000..a7ca94f3c9 --- /dev/null +++ b/2026/CVE-2026-14941.md @@ -0,0 +1,17 @@ +### [CVE-2026-14941](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14941) +![](https://img.shields.io/static/v1?label=Product&message=Customer%20Reviews%20for%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/572ba4a2-1b51-4631-9c28-7cc3d44f0761/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15047.md b/2026/CVE-2026-15047.md new file mode 100644 index 0000000000..71c5f40176 --- /dev/null +++ b/2026/CVE-2026-15047.md @@ -0,0 +1,17 @@ +### [CVE-2026-15047](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15047) +![](https://img.shields.io/static/v1?label=Product&message=s2Member&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS). + +### POC + +#### Reference +- https://wpscan.com/vulnerability/79e830c3-232b-4eff-8cf1-d25c5310984c/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15229.md b/2026/CVE-2026-15229.md new file mode 100644 index 0000000000..732d697bb1 --- /dev/null +++ b/2026/CVE-2026-15229.md @@ -0,0 +1,17 @@ +### [CVE-2026-15229](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15229) +![](https://img.shields.io/static/v1?label=Product&message=Pinpoint%20Booking%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brightgreen) + +### Description + +The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/be12c266-dee7-463d-ae71-9f7b7e0258ee/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15237.md b/2026/CVE-2026-15237.md new file mode 100644 index 0000000000..433019fd05 --- /dev/null +++ b/2026/CVE-2026-15237.md @@ -0,0 +1,17 @@ +### [CVE-2026-15237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15237) +![](https://img.shields.io/static/v1?label=Product&message=MotoPress%20Hotel%20Booking&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/b312a323-808c-497f-b67e-3b0acfcb8932/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15238.md b/2026/CVE-2026-15238.md new file mode 100644 index 0000000000..c09a957339 --- /dev/null +++ b/2026/CVE-2026-15238.md @@ -0,0 +1,17 @@ +### [CVE-2026-15238](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15238) +![](https://img.shields.io/static/v1?label=Product&message=MotoPress%20Hotel%20Booking&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/7283a28a-7241-4b9e-8fc5-5b427191c80e/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16257.md b/2026/CVE-2026-16257.md new file mode 100644 index 0000000000..e056a86b8c --- /dev/null +++ b/2026/CVE-2026-16257.md @@ -0,0 +1,17 @@ +### [CVE-2026-16257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16257) +![](https://img.shields.io/static/v1?label=Product&message=Arvow%20AI%20SEO%20Writer&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/89c32854-1cf1-4fe9-a6d0-6244be2dcc03/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16298.md b/2026/CVE-2026-16298.md new file mode 100644 index 0000000000..738f156999 --- /dev/null +++ b/2026/CVE-2026-16298.md @@ -0,0 +1,17 @@ +### [CVE-2026-16298](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16298) +![](https://img.shields.io/static/v1?label=Product&message=FoodBoxBooker&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%20Improper%20Privilege%20Management&color=brightgreen) + +### Description + +The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/d554361c-e6c7-4843-a9cc-005b08685a5b/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16299.md b/2026/CVE-2026-16299.md new file mode 100644 index 0000000000..1ed17f2f40 --- /dev/null +++ b/2026/CVE-2026-16299.md @@ -0,0 +1,17 @@ +### [CVE-2026-16299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16299) +![](https://img.shields.io/static/v1?label=Product&message=Single%20Sign%20On%20For%20TNG&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/06532a5a-ad34-421e-81e3-b4e44e8023ab/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16949.md b/2026/CVE-2026-16949.md new file mode 100644 index 0000000000..51b2e28733 --- /dev/null +++ b/2026/CVE-2026-16949.md @@ -0,0 +1,17 @@ +### [CVE-2026-16949](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16949) +![](https://img.shields.io/static/v1?label=Product&message=Term%20Pages&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen) + +### Description + +The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/3e07356a-5ac8-4d9f-bef2-65aaecbf1419/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16985.md b/2026/CVE-2026-16985.md new file mode 100644 index 0000000000..ab09a0cea3 --- /dev/null +++ b/2026/CVE-2026-16985.md @@ -0,0 +1,17 @@ +### [CVE-2026-16985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16985) +![](https://img.shields.io/static/v1?label=Product&message=Squeeze&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen) + +### Description + +The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/045a15f3-5750-4c4e-977d-e1283e3c967d/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17010.md b/2026/CVE-2026-17010.md new file mode 100644 index 0000000000..59a9deee7f --- /dev/null +++ b/2026/CVE-2026-17010.md @@ -0,0 +1,17 @@ +### [CVE-2026-17010](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17010) +![](https://img.shields.io/static/v1?label=Product&message=Saitama%20Addon%20Pack&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/1e760dbf-7efc-4511-9a05-2d1476eb3dfb/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17012.md b/2026/CVE-2026-17012.md new file mode 100644 index 0000000000..a073714ea7 --- /dev/null +++ b/2026/CVE-2026-17012.md @@ -0,0 +1,17 @@ +### [CVE-2026-17012](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17012) +![](https://img.shields.io/static/v1?label=Product&message=Accept%20PayPal%20%26%20Stripe%20with%20Subscriptions%20for%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen) + +### Description + +The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/01cc2578-8bf8-4889-9e21-7b78cae074d7/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17016.md b/2026/CVE-2026-17016.md new file mode 100644 index 0000000000..801af0cacd --- /dev/null +++ b/2026/CVE-2026-17016.md @@ -0,0 +1,17 @@ +### [CVE-2026-17016](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17016) +![](https://img.shields.io/static/v1?label=Product&message=Accept%20PayPal%20%26%20Stripe%20with%20Subscriptions%20for%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen) + +### Description + +The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/fb73461f-521a-401b-98d0-5f32272368b8/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17018.md b/2026/CVE-2026-17018.md new file mode 100644 index 0000000000..a57352329b --- /dev/null +++ b/2026/CVE-2026-17018.md @@ -0,0 +1,17 @@ +### [CVE-2026-17018](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17018) +![](https://img.shields.io/static/v1?label=Product&message=CubeWP%20Framework&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/df87c8d0-b3f3-4995-ac95-d63544e71a32/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17019.md b/2026/CVE-2026-17019.md new file mode 100644 index 0000000000..177070c526 --- /dev/null +++ b/2026/CVE-2026-17019.md @@ -0,0 +1,17 @@ +### [CVE-2026-17019](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17019) +![](https://img.shields.io/static/v1?label=Product&message=JetEngine&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). + +### POC + +#### Reference +- https://wpscan.com/vulnerability/355ea90d-9fb3-4dc6-9676-48e5255fbc77/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17020.md b/2026/CVE-2026-17020.md new file mode 100644 index 0000000000..0eda3e9546 --- /dev/null +++ b/2026/CVE-2026-17020.md @@ -0,0 +1,17 @@ +### [CVE-2026-17020](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17020) +![](https://img.shields.io/static/v1?label=Product&message=Salon%20Booking%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/6e7852e9-0acd-4a79-9240-b864b14459a3/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17021.md b/2026/CVE-2026-17021.md new file mode 100644 index 0000000000..434dcf3e40 --- /dev/null +++ b/2026/CVE-2026-17021.md @@ -0,0 +1,17 @@ +### [CVE-2026-17021](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17021) +![](https://img.shields.io/static/v1?label=Product&message=Salon%20Booking%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/fbbfa907-3efd-4050-9651-d3836af062a9/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17022.md b/2026/CVE-2026-17022.md new file mode 100644 index 0000000000..2e05de51a5 --- /dev/null +++ b/2026/CVE-2026-17022.md @@ -0,0 +1,17 @@ +### [CVE-2026-17022](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17022) +![](https://img.shields.io/static/v1?label=Product&message=Salon%20Booking%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/ddc84492-408b-477c-ac6c-b9ec96ccf223/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17023.md b/2026/CVE-2026-17023.md new file mode 100644 index 0000000000..2d63122560 --- /dev/null +++ b/2026/CVE-2026-17023.md @@ -0,0 +1,17 @@ +### [CVE-2026-17023](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17023) +![](https://img.shields.io/static/v1?label=Product&message=Salon%20Booking%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen) + +### Description + +The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/a116db0a-38ea-43e3-a9cd-991768ce3e07/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17540.md b/2026/CVE-2026-17540.md new file mode 100644 index 0000000000..ea05bf9cbf --- /dev/null +++ b/2026/CVE-2026-17540.md @@ -0,0 +1,17 @@ +### [CVE-2026-17540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17540) +![](https://img.shields.io/static/v1?label=Product&message=File%20Manager&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen) + +### Description + +The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/096cb7df-26a5-4f5f-bbec-725e063a2b75/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17541.md b/2026/CVE-2026-17541.md new file mode 100644 index 0000000000..a9a688c3ff --- /dev/null +++ b/2026/CVE-2026-17541.md @@ -0,0 +1,17 @@ +### [CVE-2026-17541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17541) +![](https://img.shields.io/static/v1?label=Product&message=File%20Manager&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/972bf72f-08c4-41ec-b6e9-2d6083d21734/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17542.md b/2026/CVE-2026-17542.md new file mode 100644 index 0000000000..4ac14f1348 --- /dev/null +++ b/2026/CVE-2026-17542.md @@ -0,0 +1,17 @@ +### [CVE-2026-17542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17542) +![](https://img.shields.io/static/v1?label=Product&message=File%20Manager&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/d17f3de9-b0f9-4bbd-8a57-18cda9d43d79/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18030.md b/2026/CVE-2026-18030.md new file mode 100644 index 0000000000..1f78254e5e --- /dev/null +++ b/2026/CVE-2026-18030.md @@ -0,0 +1,17 @@ +### [CVE-2026-18030](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18030) +![](https://img.shields.io/static/v1?label=Product&message=BricksForge&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/15463bda-fb39-4629-b96b-34b83191bab7/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18200.md b/2026/CVE-2026-18200.md new file mode 100644 index 0000000000..c4bd7ef108 --- /dev/null +++ b/2026/CVE-2026-18200.md @@ -0,0 +1,17 @@ +### [CVE-2026-18200](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18200) +![](https://img.shields.io/static/v1?label=Product&message=FoodBoxBooker&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/a5864653-4df6-4d8d-9f8a-ace7b0220342/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18468.md b/2026/CVE-2026-18468.md new file mode 100644 index 0000000000..e89371db30 --- /dev/null +++ b/2026/CVE-2026-18468.md @@ -0,0 +1,17 @@ +### [CVE-2026-18468](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18468) +![](https://img.shields.io/static/v1?label=Product&message=Login%20%26%20Register%20Forms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/0b567954-4bcc-4e2a-a2b5-024175012a19/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18469.md b/2026/CVE-2026-18469.md new file mode 100644 index 0000000000..c1b9544733 --- /dev/null +++ b/2026/CVE-2026-18469.md @@ -0,0 +1,17 @@ +### [CVE-2026-18469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18469) +![](https://img.shields.io/static/v1?label=Product&message=Login%20%26%20Register%20Forms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/be74144a-b45b-469f-8631-7fdca6d19a66/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18470.md b/2026/CVE-2026-18470.md new file mode 100644 index 0000000000..f4f96cfb43 --- /dev/null +++ b/2026/CVE-2026-18470.md @@ -0,0 +1,17 @@ +### [CVE-2026-18470](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18470) +![](https://img.shields.io/static/v1?label=Product&message=Login%20%26%20Register%20Forms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/589b7661-4a0d-4041-8c29-2819d8b1e402/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18666.md b/2026/CVE-2026-18666.md new file mode 100644 index 0000000000..52dbc69a12 --- /dev/null +++ b/2026/CVE-2026-18666.md @@ -0,0 +1,17 @@ +### [CVE-2026-18666](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18666) +![](https://img.shields.io/static/v1?label=Product&message=Library%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen) + +### Description + +The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/7a9b3fff-f454-4764-ad60-0b273781f7b4/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18786.md b/2026/CVE-2026-18786.md new file mode 100644 index 0000000000..cce24e8c95 --- /dev/null +++ b/2026/CVE-2026-18786.md @@ -0,0 +1,17 @@ +### [CVE-2026-18786](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18786) +![](https://img.shields.io/static/v1?label=Product&message=CheckView&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/f53e1706-e926-4a2c-a2a7-465b4ca5d102/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18934.md b/2026/CVE-2026-18934.md new file mode 100644 index 0000000000..415b7965bd --- /dev/null +++ b/2026/CVE-2026-18934.md @@ -0,0 +1,17 @@ +### [CVE-2026-18934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18934) +![](https://img.shields.io/static/v1?label=Product&message=RSS%20Aggregator%20by%20Feedzy&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brightgreen) + +### Description + +The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/f87c5a11-59a1-47cc-bc1c-d12108b510ab/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18946.md b/2026/CVE-2026-18946.md new file mode 100644 index 0000000000..66b669092a --- /dev/null +++ b/2026/CVE-2026-18946.md @@ -0,0 +1,17 @@ +### [CVE-2026-18946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18946) +![](https://img.shields.io/static/v1?label=Product&message=Contact%20Form%20to%20Any%20API&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/fa13ebbb-8eea-492d-8f59-58228efb94d8/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18960.md b/2026/CVE-2026-18960.md new file mode 100644 index 0000000000..fcdb5b1d79 --- /dev/null +++ b/2026/CVE-2026-18960.md @@ -0,0 +1,17 @@ +### [CVE-2026-18960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18960) +![](https://img.shields.io/static/v1?label=Product&message=Block%20User%20Account&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/c80abded-9f0e-4e44-8c8a-b0d1bc1b16d0/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19049.md b/2026/CVE-2026-19049.md new file mode 100644 index 0000000000..dd388db77b --- /dev/null +++ b/2026/CVE-2026-19049.md @@ -0,0 +1,17 @@ +### [CVE-2026-19049](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19049) +![](https://img.shields.io/static/v1?label=Product&message=ProSolution%20WP%20Client&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen) + +### Description + +The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/5405c86c-1cf5-4123-9dea-864096d07520/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19053.md b/2026/CVE-2026-19053.md new file mode 100644 index 0000000000..0da623ae02 --- /dev/null +++ b/2026/CVE-2026-19053.md @@ -0,0 +1,17 @@ +### [CVE-2026-19053](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19053) +![](https://img.shields.io/static/v1?label=Product&message=ProSolution%20WP%20Client&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen) + +### Description + +The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/c9bad349-d2d6-4b67-a107-818f25d9bf76/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19074.md b/2026/CVE-2026-19074.md new file mode 100644 index 0000000000..2a43bf6b8a --- /dev/null +++ b/2026/CVE-2026-19074.md @@ -0,0 +1,18 @@ +### [CVE-2026-19074](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19074) +![](https://img.shields.io/static/v1?label=Product&message=Advanced%20Classifieds%20%26%20Directory%20Pro&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/657cb9f9-8be6-4841-b8a1-93d26a3d7984/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19075.md b/2026/CVE-2026-19075.md new file mode 100644 index 0000000000..93b16859b7 --- /dev/null +++ b/2026/CVE-2026-19075.md @@ -0,0 +1,17 @@ +### [CVE-2026-19075](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19075) +![](https://img.shields.io/static/v1?label=Product&message=All-in-One%20Video%20Gallery&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/ad70162f-5514-41b8-84af-c79c2f881567/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19077.md b/2026/CVE-2026-19077.md new file mode 100644 index 0000000000..b50a3516e4 --- /dev/null +++ b/2026/CVE-2026-19077.md @@ -0,0 +1,17 @@ +### [CVE-2026-19077](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19077) +![](https://img.shields.io/static/v1?label=Product&message=Duplicate%20Post&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/dcced434-f7c0-4e19-b3cb-8196f6636aa3/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19089.md b/2026/CVE-2026-19089.md new file mode 100644 index 0000000000..a47351a8be --- /dev/null +++ b/2026/CVE-2026-19089.md @@ -0,0 +1,17 @@ +### [CVE-2026-19089](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19089) +![](https://img.shields.io/static/v1?label=Product&message=Product%20Input%20Fields%20for%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen) + +### Description + +The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/c5728a31-de92-40df-ab19-aec4db84ba21/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-4183.md b/2026/CVE-2026-4183.md new file mode 100644 index 0000000000..3e9a404f91 --- /dev/null +++ b/2026/CVE-2026-4183.md @@ -0,0 +1,18 @@ +### [CVE-2026-4183](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4183) +![](https://img.shields.io/static/v1?label=Product&message=DIR-816&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.10CNB05%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSetup.cgi of the component goahead. Such manipulation of the argument pskValue leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer. + +### POC + +#### Reference +- https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_87/87.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-42096.md b/2026/CVE-2026-42096.md index b21d9a3c76..b45114bca1 100644 --- a/2026/CVE-2026-42096.md +++ b/2026/CVE-2026-42096.md @@ -11,6 +11,7 @@ Sparx Pro Cloud Server is vulnerable to Broken Access Control within communicati #### Reference - https://efigo.pl/blog/CVE-2026-42096/ +- https://sparxsystems.com/products/procloudserver/ - https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html #### Github diff --git a/2026/CVE-2026-42097.md b/2026/CVE-2026-42097.md index a69752531b..e56fdf9b2d 100644 --- a/2026/CVE-2026-42097.md +++ b/2026/CVE-2026-42097.md @@ -11,6 +11,7 @@ Sparx Pro Cloud Server requires authentication based on requested URL. An atta #### Reference - https://efigo.pl/blog/CVE-2026-42096/ +- https://sparxsystems.com/products/procloudserver/ - https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html #### Github diff --git a/2026/CVE-2026-42099.md b/2026/CVE-2026-42099.md index dc6b45ed13..f6908245e9 100644 --- a/2026/CVE-2026-42099.md +++ b/2026/CVE-2026-42099.md @@ -11,6 +11,7 @@ Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_int #### Reference - https://efigo.pl/blog/CVE-2026-42096/ +- https://sparxsystems.com/products/procloudserver/ - https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html #### Github diff --git a/2026/CVE-2026-42100.md b/2026/CVE-2026-42100.md index 03298351ca..ec54e52edc 100644 --- a/2026/CVE-2026-42100.md +++ b/2026/CVE-2026-42100.md @@ -11,6 +11,7 @@ Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server a #### Reference - https://efigo.pl/blog/CVE-2026-42096/ +- https://sparxsystems.com/products/procloudserver/ - https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html #### Github diff --git a/2026/CVE-2026-4552.md b/2026/CVE-2026-4552.md new file mode 100644 index 0000000000..f2596a9fe0 --- /dev/null +++ b/2026/CVE-2026-4552.md @@ -0,0 +1,18 @@ +### [CVE-2026-4552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4552) +![](https://img.shields.io/static/v1?label=Product&message=F453&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A vulnerability was determined in Tenda F453 1.0.0.3. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component Parameters Handler. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. + +### POC + +#### Reference +- https://github.com/Litengzheng/vul_db/blob/main/F453/vul_87/README.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-4878.md b/2026/CVE-2026-4878.md index 45ebbc3ca2..b0117ed387 100644 --- a/2026/CVE-2026-4878.md +++ b/2026/CVE-2026-4878.md @@ -26,7 +26,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.17&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.18&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.19&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.9.0&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.9.2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Update%20Infrastructure%205&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Time-of-check%20Time-of-use%20(TOCTOU)%20Race%20Condition&color=brightgreen) diff --git a/2026/CVE-2026-52880.md b/2026/CVE-2026-52880.md new file mode 100644 index 0000000000..45e592ae8d --- /dev/null +++ b/2026/CVE-2026-52880.md @@ -0,0 +1,18 @@ +### [CVE-2026-52880](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52880) +![](https://img.shields.io/static/v1?label=Product&message=klever-go&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.7.14%2C%20%3C%201.7.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with no ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured. As a result, incoming connections that never complete their request headers are held open indefinitely. When a REST listener is reachable beyond localhost through the documented all-interface bind or a Docker port-publish deployment, a single unauthenticated client can open many slow-header connections and hold them open until server file descriptors are exhausted, preventing the API from accepting new connections. This renders the REST API unavailable to legitimate clients. This issue is fixed in version 1.7.18. + +### POC + +#### Reference +- https://github.com/klever-io/klever-go/security/advisories/GHSA-w4c6-7r69-w7j9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65007.md b/2026/CVE-2026-65007.md new file mode 100644 index 0000000000..fbc4125958 --- /dev/null +++ b/2026/CVE-2026-65007.md @@ -0,0 +1,18 @@ +### [CVE-2026-65007](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65007) +![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65008.md b/2026/CVE-2026-65008.md new file mode 100644 index 0000000000..3255f914cf --- /dev/null +++ b/2026/CVE-2026-65008.md @@ -0,0 +1,18 @@ +### [CVE-2026-65008](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65008) +![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command then executes as the web-server user whenever anyone — including an unauthenticated visitor — accesses the page. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65009.md b/2026/CVE-2026-65009.md new file mode 100644 index 0000000000..c84e7c238a --- /dev/null +++ b/2026/CVE-2026-65009.md @@ -0,0 +1,18 @@ +### [CVE-2026-65009](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65009) +![](https://img.shields.io/static/v1?label=Product&message=openremote&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) + +### Description + +OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment. + +### POC + +#### Reference +- https://github.com/openremote/openremote/security/advisories/GHSA-fv8q-rwj8-2c55 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65010.md b/2026/CVE-2026-65010.md new file mode 100644 index 0000000000..1c1c586031 --- /dev/null +++ b/2026/CVE-2026-65010.md @@ -0,0 +1,18 @@ +### [CVE-2026-65010](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65010) +![](https://img.shields.io/static/v1?label=Product&message=datasets&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=UNIX%20Symbolic%20Link%20(Symlink)%20Following&color=brightgreen) + +### Description + +Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution. + +### POC + +#### Reference +- https://github.com/huggingface/datasets/issues/8296 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65011.md b/2026/CVE-2026-65011.md new file mode 100644 index 0000000000..e196b4e364 --- /dev/null +++ b/2026/CVE-2026-65011.md @@ -0,0 +1,18 @@ +### [CVE-2026-65011](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65011) +![](https://img.shields.io/static/v1?label=Product&message=graylog2-server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them. + +### POC + +#### Reference +- https://github.com/Graylog2/graylog2-server/issues/26590 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65056.md b/2026/CVE-2026-65056.md new file mode 100644 index 0000000000..63872805c2 --- /dev/null +++ b/2026/CVE-2026-65056.md @@ -0,0 +1,17 @@ +### [CVE-2026-65056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65056) +![](https://img.shields.io/static/v1?label=Product&message=mcp-webresearch&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool, which only validates the URL protocol without filtering private or reserved IP ranges. Attackers can steer the LLM-controlled URL argument through prompt injection to navigate the server's Playwright browser to internal endpoints such as cloud instance metadata services, causing the server to return sensitive internal page content including credentials into the model context. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/mcp-webresearch.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65057.md b/2026/CVE-2026-65057.md new file mode 100644 index 0000000000..28b6b5fa9f --- /dev/null +++ b/2026/CVE-2026-65057.md @@ -0,0 +1,17 @@ +### [CVE-2026-65057](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65057) +![](https://img.shields.io/static/v1?label=Product&message=keep&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance. + +### POC + +#### Reference +- https://github.com/keephq/keep/issues/6630 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65317.md b/2026/CVE-2026-65317.md new file mode 100644 index 0000000000..c0ae78a6c1 --- /dev/null +++ b/2026/CVE-2026-65317.md @@ -0,0 +1,17 @@ +### [CVE-2026-65317](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65317) +![](https://img.shields.io/static/v1?label=Product&message=Verba&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host and port values. Attackers can bypass the localhost origin check in the API middleware by sending any Origin value prefixed with ' regardless of port, then submit arbitrary host and port parameters to the /api/connect endpoint to cause the server to issue outbound GET requests to attacker-controlled infrastructure. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/verba.md#finding-2-ssrf--same-origin-middleware-bypass-in-apiconnect----goldenverba + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65318.md b/2026/CVE-2026-65318.md new file mode 100644 index 0000000000..85e55fffc9 --- /dev/null +++ b/2026/CVE-2026-65318.md @@ -0,0 +1,17 @@ +### [CVE-2026-65318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65318) +![](https://img.shields.io/static/v1?label=Product&message=Verba&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can connect to the /ws/import_files WebSocket endpoint without authentication, specify arbitrary URLs in the HTMLReader configuration, and cause the server to fetch internal resources such as co-located database endpoints or cloud instance metadata services to retrieve sensitive credentials. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/verba.md#finding-1-unauthenticated-ssrf-in-verba-websocket-import-endpoint-htmlreader + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65319.md b/2026/CVE-2026-65319.md new file mode 100644 index 0000000000..d927960d91 --- /dev/null +++ b/2026/CVE-2026-65319.md @@ -0,0 +1,17 @@ +### [CVE-2026-65319](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65319) +![](https://img.shields.io/static/v1?label=Product&message=Feedbin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) + +### Description + +Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and extract plain-text content of all stored articles, including private newsletter content, personal page-saves, and articles from any user's private subscriptions. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/feedbin.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65321.md b/2026/CVE-2026-65321.md new file mode 100644 index 0000000000..df377d67ec --- /dev/null +++ b/2026/CVE-2026-65321.md @@ -0,0 +1,18 @@ +### [CVE-2026-65321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65321) +![](https://img.shields.io/static/v1?label=Product&message=PyAthena&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker-supplied input such as a single quote followed by SQL syntax causes the parser to terminate the string literal prematurely, enabling data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content. + +### POC + +#### Reference +- https://github.com/rahulreddykarne/CVE-2026-65321-pyathena + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65600.md b/2026/CVE-2026-65600.md new file mode 100644 index 0000000000..2cbc092efb --- /dev/null +++ b/2026/CVE-2026-65600.md @@ -0,0 +1,20 @@ +### [CVE-2026-65600](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65600) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7. + +### POC + +#### Reference +- https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65601.md b/2026/CVE-2026-65601.md new file mode 100644 index 0000000000..eb8e12f39c --- /dev/null +++ b/2026/CVE-2026-65601.md @@ -0,0 +1,18 @@ +### [CVE-2026-65601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65601) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7. + +### POC + +#### Reference +- https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65602.md b/2026/CVE-2026-65602.md new file mode 100644 index 0000000000..0c0f4eab3b --- /dev/null +++ b/2026/CVE-2026-65602.md @@ -0,0 +1,19 @@ +### [CVE-2026-65602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65602) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7. + +### POC + +#### Reference +- https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65603.md b/2026/CVE-2026-65603.md new file mode 100644 index 0000000000..192ffc988f --- /dev/null +++ b/2026/CVE-2026-65603.md @@ -0,0 +1,18 @@ +### [CVE-2026-65603](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65603) +![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Privilege%20Management&color=brightgreen) + +### Description + +The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65604.md b/2026/CVE-2026-65604.md new file mode 100644 index 0000000000..3432f8a64c --- /dev/null +++ b/2026/CVE-2026-65604.md @@ -0,0 +1,17 @@ +### [CVE-2026-65604](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65604) +![](https://img.shields.io/static/v1?label=Product&message=skipper&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Input%20Validation&color=brightgreen) + +### Description + +Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only. + +### POC + +#### Reference +- https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65605.md b/2026/CVE-2026-65605.md new file mode 100644 index 0000000000..b1c0c15808 --- /dev/null +++ b/2026/CVE-2026-65605.md @@ -0,0 +1,18 @@ +### [CVE-2026-65605](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65605) +![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as are skipped by that check, a payload like is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution. + +### POC + +#### Reference +- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65606.md b/2026/CVE-2026-65606.md new file mode 100644 index 0000000000..9446203b41 --- /dev/null +++ b/2026/CVE-2026-65606.md @@ -0,0 +1,18 @@ +### [CVE-2026-65606](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65606) +![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution. + +### POC + +#### Reference +- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wp64-x7qh-h728 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65607.md b/2026/CVE-2026-65607.md new file mode 100644 index 0000000000..2f2d5435dd --- /dev/null +++ b/2026/CVE-2026-65607.md @@ -0,0 +1,18 @@ +### [CVE-2026-65607](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65607) +![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection. + +### POC + +#### Reference +- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65608.md b/2026/CVE-2026-65608.md new file mode 100644 index 0000000000..b621c832e7 --- /dev/null +++ b/2026/CVE-2026-65608.md @@ -0,0 +1,18 @@ +### [CVE-2026-65608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65608) +![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Externally-Controlled%20Input%20to%20Select%20Classes%20or%20Code%20('Unsafe%20Reflection')&color=brightgreen) + +### Description + +Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registers this handler for every Flex directory, it bypasses the validation added to Blueprint::dynamicData() in 2.0.7 (GHSA-fj2p-qj2f-74v5). Any authenticated user with create or update permission on any Flex-based directory (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can execute arbitrary shell commands on the server. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65623.md b/2026/CVE-2026-65623.md index ba5e271476..b2938eaee0 100644 --- a/2026/CVE-2026-65623.md +++ b/2026/CVE-2026-65623.md @@ -12,6 +12,7 @@ Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauth #### Reference - https://cna.erlef.org/cves/CVE-2026-65623.html +- https://github.com/mtrudel/bandit/security/advisories/GHSA-vg8x-66vg-5pxh #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-65635.md b/2026/CVE-2026-65635.md index ccb240442c..ce0f89afb9 100644 --- a/2026/CVE-2026-65635.md +++ b/2026/CVE-2026-65635.md @@ -12,6 +12,7 @@ Improper Isolation or Compartmentalization vulnerability in malach-it boruta (El #### Reference - https://cna.erlef.org/cves/CVE-2026-65635.html +- https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-65636.md b/2026/CVE-2026-65636.md index fed7b88561..f4579826f5 100644 --- a/2026/CVE-2026-65636.md +++ b/2026/CVE-2026-65636.md @@ -12,6 +12,7 @@ Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Eli #### Reference - https://cna.erlef.org/cves/CVE-2026-65636.html +- https://github.com/ufirstgroup/ymlr/security/advisories/GHSA-p8qx-7cp9-v6c9 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-65693.md b/2026/CVE-2026-65693.md new file mode 100644 index 0000000000..012200f696 --- /dev/null +++ b/2026/CVE-2026-65693.md @@ -0,0 +1,17 @@ +### [CVE-2026-65693](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65693) +![](https://img.shields.io/static/v1?label=Product&message=microweber&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch. + +### POC + +#### Reference +- https://gist.github.com/W40X/584f4b088d310bc5280cc74bbf97831a + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65696.md b/2026/CVE-2026-65696.md new file mode 100644 index 0000000000..f45eaa8b75 --- /dev/null +++ b/2026/CVE-2026-65696.md @@ -0,0 +1,17 @@ +### [CVE-2026-65696](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65696) +![](https://img.shields.io/static/v1?label=Product&message=overseerr&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/overseerr.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65699.md b/2026/CVE-2026-65699.md new file mode 100644 index 0000000000..405a682cdf --- /dev/null +++ b/2026/CVE-2026-65699.md @@ -0,0 +1,17 @@ +### [CVE-2026-65699](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65699) +![](https://img.shields.io/static/v1?label=Product&message=AgentGPT&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target run_id in the request body without ownership verification. The AgentCRUD.create_task and validate_task_count functions look up the target AgentRun using the client-supplied run_id without confirming the run belongs to the requesting user, enabling an attacker who obtains a valid run_id to corrupt task history, exhaust the per-run loop budget, and drive LLM costs against the victim's run. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/AgentGPT.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65700.md b/2026/CVE-2026-65700.md new file mode 100644 index 0000000000..27768bea1d --- /dev/null +++ b/2026/CVE-2026-65700.md @@ -0,0 +1,17 @@ +### [CVE-2026-65700](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65700) +![](https://img.shields.io/static/v1?label=Product&message=h2ogpt&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.path.join, and because the default API key is EMPTY authentication is bypassed, enabling attackers to traverse outside the intended user directory through the file content, delete, and upload endpoints to achieve remote code execution by writing to startup hooks or application-loaded files. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/h2ogpt.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65701.md b/2026/CVE-2026-65701.md new file mode 100644 index 0000000000..0a7873a9fc --- /dev/null +++ b/2026/CVE-2026-65701.md @@ -0,0 +1,17 @@ +### [CVE-2026-65701](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65701) +![](https://img.shields.io/static/v1?label=Product&message=so-vits-svc&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side paths verbatim to librosa.load, torchaudio.load, and soundfile.write sinks, causing the server to decode and return file contents via the HTTP response body while also writing attacker-specified .wav files to arbitrary locations on the filesystem. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/so-vits-svc.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65707.md b/2026/CVE-2026-65707.md new file mode 100644 index 0000000000..5c7209b6ff --- /dev/null +++ b/2026/CVE-2026-65707.md @@ -0,0 +1,17 @@ +### [CVE-2026-65707](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65707) +![](https://img.shields.io/static/v1?label=Product&message=likeshop&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages. + +### POC + +#### Reference +- https://gist.github.com/peoz14/794521dc40f5bb7e6a6ec6630d894be6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65711.md b/2026/CVE-2026-65711.md new file mode 100644 index 0000000000..f88393bdfa --- /dev/null +++ b/2026/CVE-2026-65711.md @@ -0,0 +1,17 @@ +### [CVE-2026-65711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65711) +![](https://img.shields.io/static/v1?label=Product&message=sysPass&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger. + +### POC + +#### Reference +- https://gist.github.com/sermikr0/16bcbc799dc33d39d5714db9bbcbdb77 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65834.md b/2026/CVE-2026-65834.md new file mode 100644 index 0000000000..168741450d --- /dev/null +++ b/2026/CVE-2026-65834.md @@ -0,0 +1,18 @@ +### [CVE-2026-65834](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65834) +![](https://img.shields.io/static/v1?label=Product&message=capsule&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.13.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-248%3A%20Uncaught%20Exception&color=brightgreen) + +### Description + +Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8. + +### POC + +#### Reference +- https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65835.md b/2026/CVE-2026-65835.md new file mode 100644 index 0000000000..8d3621944d --- /dev/null +++ b/2026/CVE-2026-65835.md @@ -0,0 +1,18 @@ +### [CVE-2026-65835](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65835) +![](https://img.shields.io/static/v1?label=Product&message=capsule&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.13.0%2C%20%3C%200.13.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%3A%20Improper%20Privilege%20Management&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard used by NamespacedItems, allowing a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration through the cluster-admin controller client. This issue is fixed in version 0.13.8. + +### POC + +#### Reference +- https://github.com/projectcapsule/capsule/security/advisories/GHSA-jr6p-8pjj-mfx6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65841.md b/2026/CVE-2026-65841.md new file mode 100644 index 0000000000..70c319c878 --- /dev/null +++ b/2026/CVE-2026-65841.md @@ -0,0 +1,17 @@ +### [CVE-2026-65841](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65841) +![](https://img.shields.io/static/v1?label=Product&message=jodit&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.13.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-80%3A%20Improper%20Neutralization%20of%20Script-Related%20HTML%20Tags%20in%20a%20Web%20Page%20(Basic%20XSS)&color=brightgreen) + +### Description + +Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6. + +### POC + +#### Reference +- https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65895.md b/2026/CVE-2026-65895.md new file mode 100644 index 0000000000..cd75ba2654 --- /dev/null +++ b/2026/CVE-2026-65895.md @@ -0,0 +1,18 @@ +### [CVE-2026-65895](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65895) +![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-4pqv-2qj5-38fp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65896.md b/2026/CVE-2026-65896.md new file mode 100644 index 0000000000..ec3be3f864 --- /dev/null +++ b/2026/CVE-2026-65896.md @@ -0,0 +1,18 @@ +### [CVE-2026-65896](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65896) +![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen) + +### Description + +Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-qjq4-jp55-4mx2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65897.md b/2026/CVE-2026-65897.md new file mode 100644 index 0000000000..0117026edc --- /dev/null +++ b/2026/CVE-2026-65897.md @@ -0,0 +1,18 @@ +### [CVE-2026-65897](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65897) +![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Privilege%20Management&color=brightgreen) + +### Description + +Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65898.md b/2026/CVE-2026-65898.md new file mode 100644 index 0000000000..55db34bc65 --- /dev/null +++ b/2026/CVE-2026-65898.md @@ -0,0 +1,18 @@ +### [CVE-2026-65898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65898) +![](https://img.shields.io/static/v1?label=Product&message=DOMPurify&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS. + +### POC + +#### Reference +- https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65899.md b/2026/CVE-2026-65899.md new file mode 100644 index 0000000000..20a4d22609 --- /dev/null +++ b/2026/CVE-2026-65899.md @@ -0,0 +1,18 @@ +### [CVE-2026-65899](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65899) +![](https://img.shields.io/static/v1?label=Product&message=DOMPurify&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Protection%20Mechanism%20Failure&color=brightgreen) + +### Description + +DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy. + +### POC + +#### Reference +- https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-65900.md b/2026/CVE-2026-65900.md new file mode 100644 index 0000000000..b71603a058 --- /dev/null +++ b/2026/CVE-2026-65900.md @@ -0,0 +1,18 @@ +### [CVE-2026-65900](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65900) +![](https://img.shields.io/static/v1?label=Product&message=DOMPurify&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside