KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when…
Obejście uwierzytelnienia w QR Menu Pro umożliwia wykorzystanie zaufanych identyfikatorów.
Wrażliwość na fikcję sesji w QR Menu umożliwia przejęcie sesji użytkownika.
Błąd kontroli dostępu w QR Menu umożliwia nadużycie uwierzytelnienia.
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this…
A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argument searchml leads to sql injection. The attack is possible to be carried out remotely. The exploit…
Przepełnienie bufora w bulk_extractor umożliwia zdalne wykonanie kodu.
Brak walidacji w funkcji `makerjs.extendObject` pozwala na kopiowanie niebezpiecznych właściwości.
A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /course/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from…
A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The…
A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in command injection. It is possible to launch the attack remotely.…
W NocoDB występuje podatność XSS, umożliwiająca atakującym kompromitację kont użytkowników.
A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack…
A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the…
A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAddCategory.php. The manipulation results in sql injection. The attack may be performed from remote.…
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in…
A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the…
Błąd walidacji URL w OpenProject pozwala na przejęcie sesji użytkownika przez atakującego.
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue…
Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict uploaded file types, allowing malicious files to be uploaded and executed…
Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to achieve remote code execution.
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated…
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2020-37012 Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a… |
Wysoki priorytet |
CVSS 9,3EPSS 0,88 % | ||
| CVE-2025-7013 Obejście uwierzytelnienia w QR Menu Pro umożliwia wykorzystanie zaufanych identyfikatorów. |
Wysoki priorytet |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2025-7015 Wrażliwość na fikcję sesji w QR Menu umożliwia przejęcie sesji użytkownika. |
Wysoki priorytet |
CVSS 9,8EPSS 0,24 % | ||
| CVE-2025-7016 Błąd kontroli dostępu w QR Menu umożliwia nadużycie uwierzytelnienia. |
Wysoki priorytet |
CVSS 9,8EPSS 0,35 % | ||
| CVE-2026-1188 In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted… |
Wysoki priorytet |
CVSS 9,8EPSS 0,49 % | ||
| CVE-2026-1552 A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argument searchml leads to sql… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2026-24857 Przepełnienie bufora w bulk_extractor umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2026-24888 Brak walidacji w funkcji `makerjs.extendObject` pozwala na kopiowanie niebezpiecznych właściwości. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1 % | ||
| CVE-2026-1545 A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /course/index.php. Executing a manipulation of the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2026-1546 A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,37 % | ||
| CVE-2026-1547 A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 3,03 % | ||
| CVE-2026-24769 W NocoDB występuje podatność XSS, umożliwiająca atakującym kompromitację kont użytkowników. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,0EPSS 0,43 % | ||
| CVE-2026-1534 A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This manipulation of the argument… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,46 % | ||
| CVE-2026-1535 A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation of the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,46 % | ||
| CVE-2026-1533 A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAddCategory.php. The… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,4 % | ||
| CVE-2025-68662 Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF… |
Wysoki priorytet |
CVSS 9,9EPSS 0,33 % | ||
| CVE-2025-69602 A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result,… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,39 % | ||
| CVE-2026-24772 Błąd walidacji URL w OpenProject pozwala na przejęcie sesji użytkownika przez atakującego. |
Wysoki priorytet |
CVSS 9,0EPSS 0,18 % | ||
| CVE-2025-57792 Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted… |
Wysoki priorytet |
CVSS 10,0EPSS 0,44 % | ||
| CVE-2025-57794 Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict… |
Wysoki priorytet |
CVSS 9,1EPSS 0,64 % | ||
| CVE-2025-57795 Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to… |
Wysoki priorytet |
CVSS 9,9EPSS 0,63 % | ||
| CVE-2026-1056 The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to,… |
Wysoki priorytet |
CVSS 9,8EPSS 13,28 % | ||
| Web Help Desk SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host… |
CISA KEV |
CVSS 9,8EPSS 84,18 % | KEVPublikacja CVE | |
| CVE-2025-40552 SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should… |
Krytyczne sygnały |
CVSS 9,8EPSS 52 % | ||
| CVE-2025-40553 SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run… |
Krytyczne sygnały |
CVSS 9,8EPSS 67,98 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 19:32 UTC – 10.11.2026, 21:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.