KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30.
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and…
On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth…
DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.
Wstrzyknięcie SQL w DobryCMS umożliwia zdalnemu atakującemu uzyskanie danych bez uwierzytelnienia.
Niewłaściwa normalizacja parametrów w CliniNET umożliwia wstrzyknięcie kodu.
Obejście uwierzytelnienia w CGM CLININET umożliwia przejęcie sesji dowolnego użytkownika.
Wstrzyknięcie SQL w module uwierzytelniania umożliwia zdalne przejęcie danych konfiguracyjnych.
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.
A flaw has been found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /admin_single_student.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out…
U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.
A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/check_studid.php. Executing a manipulation of the argument student_id can lead to sql injection. The…
A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /admin_single_student_update.php. The manipulation of the argument ID leads to sql injection. Remote…
A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. It…
A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer overflow.…
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code…
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to…
Wstrzyknięcie poleceń w openDCIM pozwala na wykonanie dowolnych komend na serwerze.
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability…
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malicious user…
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to…
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image…
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST /api/v1/auth/jellyfin` allows an unauthenticated attacker to register…
Podatność w @fastify/middie < 9.2.0 pozwala na obejście uwierzytelnienia, co umożliwia dostęp do chronionych zasobów.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-50192 Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,67 % | ||
| CVE-2026-3431 On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can… |
Wysoki priorytet |
CVSS 9,8EPSS 0,4 % | ||
| CVE-2026-3432 On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and… |
Wysoki priorytet |
CVSS 9,1EPSS 0,34 % | ||
| CVE-2025-14532 DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code… |
Wysoki priorytet |
CVSS 9,8EPSS 0,62 % | ||
| CVE-2025-12462 Wstrzyknięcie SQL w DobryCMS umożliwia zdalnemu atakującemu uzyskanie danych bez uwierzytelnienia. |
Krytyczne sygnałyCERT.pl |
CVSS 9,3EPSS 0,51 % | ||
| CVE-2025-30044 Niewłaściwa normalizacja parametrów w CliniNET umożliwia wstrzyknięcie kodu. |
Wysoki priorytet |
CVSS 9,4EPSS 0,59 % | ||
| CVE-2025-30035 Obejście uwierzytelnienia w CGM CLININET umożliwia przejęcie sesji dowolnego użytkownika. |
Wysoki priorytet |
CVSS 9,0EPSS 0,28 % | ||
| CVE-2026-2584 Wstrzyknięcie SQL w module uwierzytelniania umożliwia zdalne przejęcie danych konfiguracyjnych. |
Wysoki priorytet |
CVSS 9,3EPSS 0,53 % | ||
| CVE-2026-3000 IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files… |
Wysoki priorytet |
CVSS 9,3EPSS 0,56 % | ||
| CVE-2026-3413 A flaw has been found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /admin_single_student.php. This manipulation of the argument ID… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2026-3422 U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending… |
Wysoki priorytet |
CVSS 9,3EPSS 0,92 % | ||
| CVE-2026-2999 IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable… |
Wysoki priorytet |
CVSS 9,3EPSS 0,56 % | ||
| CVE-2026-3410 A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/check_studid.php. Executing a… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,38 % | ||
| CVE-2026-3411 A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,38 % | ||
| CVE-2026-3406 A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,38 % | ||
| CVE-2026-3400 A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,98 % | ||
| CVE-2026-3395 A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp… |
Wysoki priorytet |
CVSS 9,8EPSS 4,02 % | ||
| CVE-2026-28562 wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted… |
Wysoki priorytet |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2026-28517 Wstrzyknięcie poleceń w openDCIM pozwala na wykonanie dowolnych komend na serwerze. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 6,27 % | ||
| CVE-2026-28411 WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 2,7 % | ||
| CVE-2026-28408 WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,57 % | ||
| CVE-2026-28268 Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that… |
Wysoki priorytet |
CVSS 9,8EPSS 0,74 % | ||
| CVE-2026-28231 pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c`… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,7 % | ||
| CVE-2026-27707 Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,56 % | ||
| CVE-2026-2880 Podatność w @fastify/middie < 9.2.0 pozwala na obejście uwierzytelnienia, co umożliwia dostęp do chronionych zasobów. |
Wysoki priorytet |
CVSS 9,1EPSS 0,43 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 9.11.2026, 16:02 UTC – 9.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.