KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
Wstrzyknięcie SQL w RealMag777 TableOn umożliwia przeprowadzenie ataku typu Blind SQL Injection.
Nieprawidłowe zarządzanie ciasteczkami w Lightpanda umożliwia atakującym wykonywanie uwierzytelnionych żądań cross-origin.
Wstrzyknięcie SQL w VillaTheme GIFT4U umożliwia przeprowadzenie ataku typu Blind SQL Injection.
Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and…
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access…
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted…
Obejście zabezpieczeń w Lumiverse pozwala na zdalne wykonanie kodu w sesji użytkownika.
Luka XSS w SketchUp 2026 umożliwia zdalne wykonanie kodu i wyciek plików lokalnych.
Wykonanie zbyt wielu uprawnień w IBM Verify Identity umożliwia eskalację uprawnień do roota.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(),…
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of…
Obejście uwierzytelnienia w Cap-go umożliwia przejęcie konta przez manipulację odpowiedziami serwera.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection. This issue affects Listdom: from n/a through 5.4.0.
Wstrzyknięcie SQL w Active Products Tables for WooCommerce umożliwia przeprowadzenie ataku Blind SQL Injection.
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback…
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using…
Wstrzyknięcie skryptu w SiYuan umożliwia zdalne wykonanie poleceń systemowych.
W SiYuan przed wersją 3.7.4 występuje podatność XSS, umożliwiająca zdalne wykonanie poleceń OS.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Wstrzyknięcie SQL w RealMag777 TableOn umożliwia przeprowadzenie ataku typu Blind SQL Injection. | Wstrzyknięcie SQL w RealMag777 TableOn umożliwia przeprowadzenie ataku typu Blind SQL Injection. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Nieprawidłowe zarządzanie ciasteczkami w Lightpanda umożliwia atakującym wykonywanie uwierzytelnionych żądań cross-origin. | Nieprawidłowe zarządzanie ciasteczkami w Lightpanda umożliwia atakującym wykonywanie uwierzytelnionych żądań cross-origin. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Wstrzyknięcie SQL w VillaTheme GIFT4U umożliwia przeprowadzenie ataku typu Blind SQL Injection. | Wstrzyknięcie SQL w VillaTheme GIFT4U umożliwia przeprowadzenie ataku typu Blind SQL Injection. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. |
W tym tygodniu | 9,3 | 0,23 % | ||
| A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to… | A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and… |
W tym tygodniu | 9,3 | 0,23 % | ||
| A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker… | A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access… |
W tym tygodniu | 9,3 | 0,23 % | ||
| In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size… | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted… |
W tym tygodniu | 9,3 | 0,23 % | ||
| Obejście zabezpieczeń w Lumiverse pozwala na zdalne wykonanie kodu w sesji użytkownika. | Obejście zabezpieczeń w Lumiverse pozwala na zdalne wykonanie kodu w sesji użytkownika. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Luka XSS w SketchUp 2026 umożliwia zdalne wykonanie kodu i wyciek plików lokalnych. | Luka XSS w SketchUp 2026 umożliwia zdalne wykonanie kodu i wyciek plików lokalnych. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Wykonanie zbyt wielu uprawnień w IBM Verify Identity umożliwia eskalację uprawnień do roota. | Wykonanie zbyt wielu uprawnień w IBM Verify Identity umożliwia eskalację uprawnień do roota. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6. |
W tym tygodniu | 9,3 | 0,23 % | ||
| WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by… | WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(),… |
W tym tygodniu | 9,3 | 0,23 % | ||
| WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script… | WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of… |
W tym tygodniu | 9,3 | 0,23 % | ||
| Obejście uwierzytelnienia w Cap-go umożliwia przejęcie konta przez manipulację odpowiedziami serwera. | Obejście uwierzytelnienia w Cap-go umożliwia przejęcie konta przez manipulację odpowiedziami serwera. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection. This issue affects Listdom: from n/a through 5.4.0. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Wstrzyknięcie SQL w Active Products Tables for WooCommerce umożliwia przeprowadzenie ataku Blind SQL Injection. | Wstrzyknięcie SQL w Active Products Tables for WooCommerce umożliwia przeprowadzenie ataku Blind SQL Injection. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an… | Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback… |
W tym tygodniu | 9,3 | 0,23 % | ||
| An SQL injection vulnerability has been discovered in TSG Profleet. | An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint. |
W tym tygodniu | 9,3 | 0,23 % | ||
| A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to… | A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using… |
W tym tygodniu | 9,3 | 0,23 % | ||
| Wstrzyknięcie skryptu w SiYuan umożliwia zdalne wykonanie poleceń systemowych. | Wstrzyknięcie skryptu w SiYuan umożliwia zdalne wykonanie poleceń systemowych. |
W tym tygodniu | 9,3 | 0,22 % | ||
| W SiYuan przed wersją 3.7.4 występuje podatność XSS, umożliwiająca zdalne wykonanie poleceń OS. | W SiYuan przed wersją 3.7.4 występuje podatność XSS, umożliwiająca zdalne wykonanie poleceń OS. |
W tym tygodniu | 9,3 | 0,22 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.