Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| json-scada | CVE-2026-115328 JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read,… |
8,7 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| patch / Red Hat Hardened Images | CVE-2026-115207 A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers… |
5,5 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| fzf | CVE-2026-115319 fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated… |
2,0 | 0,1 % | Brak wpisu w KEV nie wyklucza ataków | |
| bytebase | CVE-2026-115321 Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own… |
5,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| bytebase | CVE-2026-115322 Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read… |
5,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| goploy | CVE-2026-114665 Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read… |
7,1 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| Rootblox | CVE-2026-112832 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6. |
9,8 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| Paid Member Subscriptions | CVE-2026-112842 Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2. |
6,5 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| Workreap Core | CVE-2026-112822 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4. |
8,5 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Academist Core | CVE-2026-112820 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1. |
8,1 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| ACF Extended | CVE-2026-112313 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7. |
7,1 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| goose | CVE-2026-111079 A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens,… |
7,4 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| Retool | CVE-2024-58394 Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a… |
5,1 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| CPAS Audit Management System | CVE-2024-58396 YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve… |
8,7 | 0,5 % | Brak wpisu w KEV nie wyklucza ataków | |
| E-cology | CVE-2025-71434 Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via… |
8,8 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| YiShaAdmin | CVE-2022-51022 YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory… |
8,8 | 0,79 % | Brak wpisu w KEV nie wyklucza ataków | |
| PHPOK | CVE-2022-51023 PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through… |
8,8 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Kavita | CVE-2022-51024 Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to… |
8,7 | 0,61 % | Brak wpisu w KEV nie wyklucza ataków | |
| WAPPLES | CVE-2022-51025 Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like… |
7,1 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| WPML Multilingual CMS | CVE-2023-54413 WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an… |
5,1 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| Readymade Unilevel Ecommerce MLM | CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or… |
8,8 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Sickbeard | CVE-2020-37284 Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming… |
5,1 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| E-cology | CVE-2021-48013 Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive… |
8,7 | 0,74 % | Brak wpisu w KEV nie wyklucza ataków | |
| FineReport | CVE-2021-48014 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a… |
9,3 | 2,03 % | Brak wpisu w KEV nie wyklucza ataków | |
| JeeWMS | CVE-2021-48015 JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor,… |
8,7 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 11:02 UTC – 15.11.2026, 16:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.