| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-109848 | 4.2 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pa | 2026-10-28 03:17:09 | 2026-10-28 03:17:09 |
| CVE-2026-109209 | 6.4 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 | 2026-10-28 03:17:09 | 2026-10-28 03:17:09 |
| CVE-2026-107745 | 4.2 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This make | 2026-10-28 03:17:09 | 2026-10-28 03:17:09 |
| CVE-2026-114574 | 5.0 | A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch | 2026-10-28 03:17:09 | 2026-10-22 01:16:58 |
| CVE-2026-107625 | 6.4 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2. | 2026-10-28 03:17:08 | 2026-10-28 03:17:08 |
| CVE-2026-105272 | 4.2 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pa | 2026-10-28 03:17:08 | 2026-10-28 03:17:08 |
| CVE-2015-20129 | 8.8 | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page th | 2026-10-28 03:17:08 | 2026-10-28 03:17:08 |
| CVE-2014-125138 | 8.8 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image | 2026-10-28 03:17:08 | 2026-10-28 03:17:08 |
| CVE-2025-60475 | 5.5 | A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input. | 2026-10-28 03:17:08 | 2026-10-20 22:17:42 |
| CVE-2014-125137 | 6.5 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences | 2026-10-28 03:17:07 | 2026-10-28 03:17:07 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39679
Zapisa po stranici: