107,130 results · Clear filters · Feed
-
Medium 6.3
Broken Access Control in extension "FAL Protect" (fal_protect)
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when t…
-
Medium 5.3
Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site …
-
Medium 6.9
Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default conf…
-
Medium 5.3
Insecure Direct Object Reference in extension "Analytics" (analytics)
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
-
Medium 6.9
Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requ…
-
Medium 6.3
Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other vis…
-
Medium 5.3
Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
-
Medium 6.9CVE-2026-112071 Public exploit
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the…
-
Medium 6.9CVE-2026-113468 Public exploit
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. Thi…
-
Medium 5.3
Broken Access Control in extension "Analytics" (analytics)
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
-
Medium 5.3
mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requ…
-
Medium 6.3
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials …
-
Medium 6.9
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
-
Medium 6.9
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the servi…
-
Medium 6.9
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the s…
-
Medium 6.9
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to cras…
-
Medium 6.9
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to cras…
-
Medium 6.9
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to cras…
-
Medium 4.3
QBinaryJson::fromBinaryData() integer overflow leading to OOB read
A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.
-
Medium 6.9
Multiple vulnerabilities in FacturaScripts
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid us…
-
Medium 6.9
Multiple vulnerabilities in FacturaScripts
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could …
-
Medium 6.6
Possible DOM XSS in SNS Web Administration Portal
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure a…
-
Medium 4.8
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequa…
-
Medium 6.5
ArmorX Global Technology｜ArmorX Spam - Command Injection
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.
-
Medium 6.1
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before val…
-
Medium 4.8
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the W…
-
Medium 6.4
DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authentic…
-
Medium 5.1
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting …
-
Medium 6.5
ArmorX Global Technology｜ArmorX Spam - Local File Inclusion
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.
-
Medium 4.3
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead …
-
Medium 5.3
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, s…
-
Medium 4.9
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A us…
-
Medium 5.4
UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may l…
-
Medium 6.5
An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.…
-
Medium 5.3
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send spec…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS…
-
Medium 5.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, ma…
-
Medium 5.5
A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to …
-
Medium 4.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS G…
-
Medium 5.9
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7…