Archive
8 September 2026
Vulnerabilities first published on this day (UTC), newest first.
517 results · Clear filters · Feed
-
Medium 6.5
WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
-
Medium 6.5
WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a t…
-
Medium 5.3
code-projects Student Crud Operation Backup File card_activation.sql information disclosure
A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remot…
-
Medium 6.3
code-projects Student Crud Operation edit.php sql injection
A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclose…
-
Medium 6.3
itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/us_searchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the at…
-
Medium 4.7
elenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml privileges management
A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manip…
-
Medium 4.3
vgmstream txtp txtp_parser.c add_entry resource consumption
A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such manipulation of the argument range_start/range_end leads to resource consumption. The attack…
-
Medium 6.3
vgmstream txth-txtp txth.c sscanf stack-based overflow
A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. Th…
-
Medium 5.3
java-json-tools jackson-coreutils JSON Pointer parser TreePointer.java TreePointer.tokensFromInput allocation of resources
A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parse…
-
Medium 6.3
java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipul…
-
Medium 5.3
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a loca…
-
Medium 5.7
Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose…
-
Medium 5.9
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary …
-
Medium 5.8
Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a craf…
-
Medium 5.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user …
-
Medium 5.7
Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-ser…
-
Medium 5.9
Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and …
-
Medium 5.7
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassin…
-
Medium 5.3
java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consu…
-
Medium 5.8
Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify ha…
-
Medium 4.3
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with…
-
Medium 6.5
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/…
-
Medium 6.5
Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in informa…
-
Medium 4.3
Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of sec…
-
Medium 4.3
Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them…
-
Medium 4.6
Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with…
-
Medium 6.5
SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive…
-
Medium 4.3
U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP.
-
Medium 6.5
L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList …
-
Medium 6.5
A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x a…
-
Medium 6.6
An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDo…
-
Medium 5.4CVE-2026-52307 Public exploit
An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5…
-
Medium 4.6
In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let atta…
-
Medium 6.1
Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature.
-
Medium 6.1
Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction.
-
Medium 6.5CVE-2026-78838 Public exploit
A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allo…
-
Medium 6.1
Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature.