| WordPress Core Remote File Inclusion Vulnerability CVE-2026-87902 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB | webapps | multiple | 2026-09-22 |
| A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended. CVE-2026-100885 · NVD, GitHub advisories, Exploit-DB | webapps | multiple | 2026-09-27 |
| MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability CVE-2026-86060 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB | remote | multiple | 2026-09-05 |
| ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user. CVE-2026-80428 · NVD, Exploit-DB | remote | multiple | 2026-08-26 |
| Sangoma FreePBX Authentication Bypass Vulnerability CVE-2025-57819 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB, Metasploit exploit modules | webapps | Linux / multiple | 2025-08-28 |
| CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5. CVE-2026-54644 · NVD, Exploit-DB | webapps | multiple | 2026-08-31 |
| CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5. CVE-2026-54647 · NVD, Exploit-DB | webapps | multiple | 2026-08-31 |
| CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5. CVE-2026-54645 · NVD, Exploit-DB | webapps | multiple | 2026-08-31 |
| CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5. CVE-2026-54646 · NVD, Exploit-DB | webapps | multiple | 2026-08-31 |
| The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml. CVE-2026-51134 · NVD, Exploit-DB | webapps | multiple | 2026-08-31 |
| Craft CMS Code Injection Vulnerability CVE-2025-32432 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB, Metasploit exploit modules | webapps | Linux,PHP / multiple | 2025-04-14 |
| RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed the browser executes embedded JavaScript, leading to stored Cross-Site Scripting (XSS) which when combined with a CSRF misconfiguration they lead to achieve full administrative account takeover, creating a rogue admin account, escalating the attacker account role to admin, and much more. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2. CVE-2025-65027 · NVD, Exploit-DB | webapps | multiple | 2025-12-03 |
| Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users (e.g., administrators) to execute arbitrary system commands on the server. While having Django’s DEBUG=True makes exploitation visibly easier by returning command output in the HTTP response, this is not required. The vulnerability can still be exploited in DEBUG=False mode by using blind payloads such as a reverse shell, leading to full remote code execution. This issue has been patched in version 1.3.1. CVE-2025-48868 · NVD, Exploit-DB | webapps | multiple | 2025-09-24 |
| Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability CVE-2025-0282 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB | remote | multiple | 2025-01-08 |
| In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. CVE-2021-41318 · NVD, Exploit-DB | webapps | multiple | 2021-09-28 |
| Oracle WebLogic Server, Injection CVE-2019-2725 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB, Metasploit exploit modules | remote | Solaris,Unix,Windows / multiple / windows | 2019-04-23 |
| Oracle JRE Sandbox Bypass Vulnerability CVE-2013-0431 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB, Metasploit exploit modules | remote | Java,Linux,OSX,Windows / multiple | 2013-01-19 |
| Adobe ColdFusion Directory Traversal Vulnerability CVE-2010-2861 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB | remote | multiple | 2010-08-11 |
| Red Hat JBoss Authentication Bypass Vulnerability CVE-2010-0738 · CISA Known Exploited Vulnerabilities, NVD, Exploit-DB, Metasploit exploit modules | remote | Java,Linux,Windows / jsp / multiple | 2010-04-26 |
| The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode. CVE-2006-3011 · NVD, Exploit-DB | local | multiple | 2006-06-26 |
| HotJava Browser 3.0 allows remote attackers to access the DOM of a web page by opening a javascript: URL in a named window. CVE-2000-0958 · NVD, Exploit-DB | remote | multiple | 2000-10-25 |
| Allaire JRun 3.0 http servlet server allows remote attackers to directly access the WEB-INF directory via a URL request that contains an extra "/" in the beginning of the request (aka the "extra leading slash"). CVE-2000-1050 · NVD, Exploit-DB | remote | multiple | 2000-10-23 |
| Voyager web server 2.01B in the demo disks for QNX 405 stores sensitive web client information in the .photon directory in the web document root, which allows remote attackers to obtain that information. CVE-2000-0904 · NVD, Exploit-DB | remote | multiple | 2000-09-01 |
| Directory traversal vulnerability in Voyager web server 2.01B in the demo disks for QNX 405 allows remote attackers to read arbitrary files via a .. (dot dot) attack. CVE-2000-0903 · NVD, Exploit-DB | remote | multiple | 2000-09-01 |
| Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via long (1) "RCPT TO," (2) "SAML FROM," or (3) "SOML FROM" commands. CVE-2000-1046 · NVD, Exploit-DB | remote | multiple | 2000-05-18 |