KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution…
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus…
Obejście uwierzytelnienia w HPE AutoPass License Server umożliwia nieautoryzowany dostęp.
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in…
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been…
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and…
On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth…
DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.
Niewłaściwa normalizacja parametrów w CliniNET umożliwia wstrzyknięcie kodu.
Obejście uwierzytelnienia w CGM CLININET umożliwia przejęcie sesji dowolnego użytkownika.
Wstrzyknięcie SQL w module uwierzytelniania umożliwia zdalne przejęcie danych konfiguracyjnych.
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.
U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.
A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may…
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code…
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to…
Wstrzyknięcie SQL w openDCIM umożliwia uwierzytelnionemu użytkownikowi wykonanie dowolnych zapytań.
Brak autoryzacji w openDCIM umożliwia nieautoryzowaną modyfikację konfiguracji aplikacji.
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to…
Podatność w @fastify/middie < 9.2.0 pozwala na obejście uwierzytelnienia, co umożliwia dostęp do chronionych zasobów.
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid…
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using…
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method…
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-48609 In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This… |
Wysoki priorytet |
CVSS 9,1EPSS 0,28 % | ||
| CVE-2025-52998 Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of… |
Wysoki priorytet |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2026-23600 Obejście uwierzytelnienia w HPE AutoPass License Server umożliwia nieautoryzowany dostęp. |
Wysoki priorytet |
CVSS 9,8EPSS 1,09 % | ||
| CVE-2025-50189 Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST… |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 0,83 % | ||
| CVE-2025-52482 Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject… |
Wysoki priorytetPubliczny PoC |
CVSS 8,3EPSS 0,43 % | ||
| CVE-2026-3431 On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can… |
Wysoki priorytet |
CVSS 9,8EPSS 0,4 % | ||
| CVE-2026-3432 On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and… |
Wysoki priorytet |
CVSS 9,1EPSS 0,34 % | ||
| CVE-2025-14532 DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code… |
Wysoki priorytet |
CVSS 9,8EPSS 0,62 % | ||
| CVE-2025-30044 Niewłaściwa normalizacja parametrów w CliniNET umożliwia wstrzyknięcie kodu. |
Wysoki priorytet |
CVSS 9,4EPSS 0,59 % | ||
| CVE-2025-30035 Obejście uwierzytelnienia w CGM CLININET umożliwia przejęcie sesji dowolnego użytkownika. |
Wysoki priorytet |
CVSS 9,0EPSS 0,28 % | ||
| CVE-2026-2584 Wstrzyknięcie SQL w module uwierzytelniania umożliwia zdalne przejęcie danych konfiguracyjnych. |
Wysoki priorytet |
CVSS 9,3EPSS 0,53 % | ||
| CVE-2026-3000 IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files… |
Wysoki priorytet |
CVSS 9,3EPSS 0,56 % | ||
| CVE-2026-3422 U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending… |
Wysoki priorytet |
CVSS 9,3EPSS 0,92 % | ||
| CVE-2026-2999 IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable… |
Wysoki priorytet |
CVSS 9,3EPSS 0,56 % | ||
| CVE-2026-3404 A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a… |
Wysoki priorytetPubliczny PoC |
CVSS 8,1EPSS 0,4 % | ||
| CVE-2026-3395 A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp… |
Wysoki priorytet |
CVSS 9,8EPSS 4,02 % | ||
| CVE-2026-28562 wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted… |
Wysoki priorytet |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2026-28516 Wstrzyknięcie SQL w openDCIM umożliwia uwierzytelnionemu użytkownikowi wykonanie dowolnych zapytań. |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 1,07 % | ||
| CVE-2026-28515 Brak autoryzacji w openDCIM umożliwia nieautoryzowaną modyfikację konfiguracji aplikacji. |
Wysoki priorytetPubliczny PoC |
CVSS 8,8EPSS 1,28 % | ||
| CVE-2026-28268 Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that… |
Wysoki priorytet |
CVSS 9,8EPSS 0,74 % | ||
| CVE-2026-2880 Podatność w @fastify/middie < 9.2.0 pozwala na obejście uwierzytelnienia, co umożliwia dostęp do chronionych zasobów. |
Wysoki priorytet |
CVSS 9,1EPSS 0,43 % | ||
| CVE-2026-27755 SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing… |
Wysoki priorytet |
CVSS 9,3EPSS 0,46 % | ||
| CVE-2026-26861 CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in… |
Wysoki priorytetPubliczny PoC |
CVSS 8,3EPSS 0,21 % | ||
| CVE-2026-26862 CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in… |
Wysoki priorytetPubliczny PoC |
CVSS 8,3EPSS 0,42 % | ||
| CVE-2026-27751 SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management… |
Wysoki priorytet |
CVSS 9,3EPSS 0,51 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 03:02 UTC – 13.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.