| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-76597 | - | Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot. | 2026-10-12 16:10:00 | 2026-08-22 15:16:21 |
| CVE-2026-76596 | - | Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table | 2026-10-12 16:10:00 | 2026-08-22 15:16:21 |
| CVE-2026-76571 | - | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauth | 2026-10-12 16:10:00 | 2026-08-22 15:16:21 |
| CVE-2026-5093 | 4.3 | The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' fun | 2026-10-12 16:10:00 | 2026-08-22 14:16:33 |
| CVE-2026-4561 | 6.4 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficie | 2026-10-12 16:10:00 | 2026-08-22 14:16:33 |
| CVE-2026-4559 | 6.4 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. Th | 2026-10-12 16:10:00 | 2026-08-22 14:16:32 |
| CVE-2026-2996 | 7.5 | The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it | 2026-10-12 16:10:00 | 2026-08-22 14:16:32 |
| CVE-2026-62382 | - | PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby ev | 2026-10-12 16:10:00 | 2026-08-22 13:16:40 |
| CVE-2026-62381 | 6.6 | luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DE | 2026-10-12 16:10:00 | 2026-08-22 13:16:39 |
| CVE-2026-62204 | 6.6 | SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoU | 2026-10-12 16:10:00 | 2026-08-22 13:16:39 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39518
Zapisa po stranici: