2026

Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manag

Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login page

Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQ

Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Confi

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize

Phpscript-sgh 0.1.0 contains a time-based blind SQL injection vulnerability in the admin interface that allows attackers

Testa Online Test Management System 3.4.7 contains a SQL injection vulnerability that allows attackers to manipulate dat

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by t

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink en

WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to b

SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that a

Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipul

The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to

berliCRM 1.0.24 contains a SQL injection vulnerability in the 'src_record' parameter that allows remote attackers to man

An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authen

Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technolog

Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries thr

e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to

Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attacke

Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulat

A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated a

60CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipul

OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows att

Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote att

PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipula

School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to mani

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker

The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPr

phpMyChat Plus 1.98 contains a SQL injection vulnerability in the deluser.php page through the pmc_username parameter th

Azure Function Information Disclosure Vulnerability

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Rev

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a

AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module's maildetail.php script through the 'id' p

QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries throu

In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible

Crafted delegations or IP fragments can poison cached delegations in Recursor.

Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information S

Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient P

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Sof

Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string.

Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated

A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected produ

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious

SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. Th

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-s

Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.

Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrect