|
1551
|
9.8 |
CRITICAL
Network
|
-
|
-
|
The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints th…
|
CWE-862
Missing Authorization
|
CVE-2026-1830
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1552
|
6.4 |
MEDIUM
Network
|
-
|
-
|
The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and im…
|
CWE-79
Cross-site Scripting
|
CVE-2026-5742
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1553
|
4.7 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was determined in PHPGurukul News Portal Project 4.1. This vulnerability affects unknown code of the file /admin/add-subadmins.php. This manipulation of the argument sadminusername ca…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-5838
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1554
|
4.7 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was identified in PHPGurukul News Portal Project 4.1. This issue affects some unknown processing of the file /admin/add-subcategory.php. Such manipulation of the argument sucatdescrip…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-5839
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1555
|
6.4 |
MEDIUM
Network
|
-
|
-
|
The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling html_entity…
|
CWE-79
Cross-site Scripting
|
CVE-2026-4336
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1556
|
4.7 |
MEDIUM
Network
|
-
|
-
|
A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performing a manipulation of the argument Usernam…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-5840
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1557
|
7.3 |
HIGH
Network
|
-
|
-
|
A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation…
|
CWE-285
CWE-639
Improper Authorization
Authorization Bypass Through User-Controlled Key
|
CVE-2026-5842
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1558
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability has been found in code-projects Movie Ticketing System 1.0. Impacted is an unknown function of the file /db/moviedb.sql of the component SQL Database Backup File Handler. Such manipul…
|
CWE-200
CWE-284
Information Exposure
Improper Access Control
|
CVE-2026-5847
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1559
|
4.7 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was found in jeecgboot JimuReport up to 2.3.0. The affected element is the function DriverManager.getConnection of the file /drag/onlDragDataSource/testConnection of the component Dat…
|
CWE-74
CWE-94
Injection
Code Injection
|
CVE-2026-5848
|
2026-04-25 03:03 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1560
|
7.6 |
HIGH
Network
|
freescout
|
freescout
|
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging cus…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-39384
|
2026-04-25 03:03 |
2026-04-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1561
|
5.3 |
MEDIUM
Network
|
-
|
-
|
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due…
|
CWE-472
External Control of Assumed-Immutable Web Parameter
|
CVE-2026-2519
|
2026-04-25 03:02 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1562
|
6.4 |
MEDIUM
Network
|
-
|
-
|
The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.94.0 due to insufficient input s…
|
CWE-79
Cross-site Scripting
|
CVE-2026-3005
|
2026-04-25 03:02 |
2026-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1563
|
6.6 |
MEDIUM
Network
|
-
|
-
|
A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1. Affected by this issue is some unknown functionality of the component Factory Reset Handler. Performing a…
|
CWE-287
Improper Authentication
|
CVE-2026-5959
|
2026-04-25 03:02 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1564
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A weakness has been identified in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /db/hcpms.sql of the component SQL Database Backup File Handler. Executi…
|
CWE-200
CWE-284
Information Exposure
Improper Access Control
|
CVE-2026-5960
|
2026-04-25 03:02 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1565
|
7.3 |
HIGH
Network
|
-
|
-
|
A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This vulnerability affects unknown code of the file /topic-details.php. The manipulation of the argument po…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-5961
|
2026-04-25 03:02 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1566
|
7.3 |
HIGH
Network
|
-
|
-
|
A security flaw has been discovered in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /crud.php. The manipulation of the argument user_Id result…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-5985
|
2026-04-25 03:02 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1567
|
5.3 |
MEDIUM
Network
|
-
|
-
|
A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of the argument timestamp causes ineffic…
|
CWE-400
CWE-1333
Uncontrolled Resource Consumption
Inefficient Regular Expression Complexity
|
CVE-2026-5986
|
2026-04-25 03:02 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1568
|
4.7 |
MEDIUM
Network
|
-
|
-
|
A security vulnerability has been detected in Sanluan PublicCMS up to 6.202506.d. This affects the function AbstractFreemarkerView.doRender of the file publiccms-parent/publiccms-core/src/main/java/c…
|
CWE-791
CWE-1336
Incomplete Filtering of Special Elements
Improper Neutralization of Special Elements Used in a Template Engine
|
CVE-2026-5987
|
2026-04-25 03:02 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1569
|
7.8 |
HIGH
Local
|
linux
|
linux_kernel
|
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
Yiming Qian reports Use-after-free in the pipapo set type:
Un…
|
CWE-416
Use After Free
|
CVE-2026-23351
|
2026-04-25 03:02 |
2026-03-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1570
|
7.8 |
HIGH
Local
|
linux
|
linux_kernel
|
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:
netfilter: nft_set_pipapo: dividir la recolección de basura en una fase de desvinculación y una fase de recuperación
Yiming Qian…
|
CWE-416
Use After Free
|
CVE-2026-23351
|
2026-04-25 03:02 |
2026-03-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1571
|
6.4 |
MEDIUM
Network
|
-
|
-
|
The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.0 due to insufficient input sanitization, insufficient output escaping, and mis…
|
CWE-79
Cross-site Scripting
|
CVE-2026-1263
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1572
|
4.3 |
MEDIUM
Network
|
-
|
-
|
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing nonce verification on the `ahsc_ajax_reset…
|
CWE-352
Origin Validation Error
|
CVE-2026-1924
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1573
|
5.4 |
MEDIUM
Network
|
-
|
-
|
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes/class-wp-optimize-heartb…
|
CWE-863
Incorrect Authorization
|
CVE-2026-2712
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1574
|
7.5 |
HIGH
Network
|
-
|
-
|
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing auth…
|
CWE-862
Missing Authorization
|
CVE-2026-3360
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1575
|
4.3 |
MEDIUM
Network
|
-
|
-
|
The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `makeMediaPrivate()` functions in all ver…
|
CWE-862
Missing Authorization
|
CVE-2026-4057
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1576
|
6.1 |
MEDIUM
Network
|
-
|
-
|
The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_template' parameter in all versions up to, and including, 1.0.16 …
|
CWE-79
Cross-site Scripting
|
CVE-2026-4305
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1577
|
6.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can…
|
CWE-266
CWE-285
Incorrect Privilege Assignment
Improper Authorization
|
CVE-2026-5999
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1578
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sql of the component SQL Database Backup File Handler. Perfor…
|
CWE-200
CWE-284
Information Exposure
Improper Access Control
|
CVE-2026-6000
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1579
|
2.4 |
LOW
Network
|
-
|
-
|
A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument f…
|
CWE-79
CWE-94
Cross-site Scripting
Code Injection
|
CVE-2026-6003
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1580
|
7.3 |
HIGH
Network
|
-
|
-
|
A vulnerability was detected in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /delete-category.php. Performing a manipulation of the argument cat_id result…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6004
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1581
|
8.1 |
HIGH
Network
|
-
|
-
|
The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS::action_handler()` method proce…
|
CWE-22
Path Traversal
|
CVE-2026-4351
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1582
|
5.3 |
MEDIUM
Network
|
-
|
-
|
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.103.0. This is due to the `create_review_permissions_check()` …
|
CWE-287
Improper Authentication
|
CVE-2026-4664
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1583
|
4.3 |
MEDIUM
Network
|
-
|
-
|
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This…
|
CWE-862
Missing Authorization
|
CVE-2026-4977
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1584
|
5.3 |
MEDIUM
Network
|
-
|
-
|
A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This man…
|
CWE-22
Path Traversal
|
CVE-2026-5998
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1585
|
6.4 |
MEDIUM
Network
|
-
|
-
|
The AddFunc Head & Footer Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `aFhfc_head_code`, `aFhfc_body_code`, and `aFhfc_footer_code` post meta values in all versions…
|
CWE-79
Cross-site Scripting
|
CVE-2026-2305
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1586
|
6.3 |
MEDIUM
Network
|
-
|
-
|
A flaw has been found in code-projects Patient Record Management System 1.0. The affected element is an unknown function of the file /hematology_print.php. Executing a manipulation of the argument he…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6005
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1587
|
6.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the file /edit_hpatient.php. The manipulation of the argument ID l…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6006
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1588
|
6.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /del.php. The manipulation of the argument equipname results in sql injectio…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6007
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1589
|
6.3 |
MEDIUM
Network
|
-
|
-
|
A security flaw has been discovered in CodeAstro Online Classroom 1.0/2.php. Affected by this vulnerability is an unknown functionality of the file /OnlineClassroom/takeassessment2.php?exid=14. Perfo…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6010
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1590
|
6.3 |
MEDIUM
Network
|
-
|
-
|
A flaw has been found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /del1.php. This manipulation of the argument toolname causes sql inje…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6030
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1591
|
7.3 |
HIGH
Network
|
-
|
-
|
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. This affects an unknown function of the file /add-category-function.php. Such manipulation of the argument Category lea…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6031
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1592
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was found in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkcheckout.php. Performing a manipulation of the argument serviceId results in c…
|
CWE-79
CWE-94
Cross-site Scripting
Code Injection
|
CVE-2026-6032
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1593
|
6.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /updatedetailsfromstudent.php?eno=146891650. Executing a manipulation of the argument fna…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6033
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1594
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /BranchManagement/ProfitAndLossReport.php. Executing a manipulation of the a…
|
CWE-79
CWE-94
Cross-site Scripting
Code Injection
|
CVE-2026-6034
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1595
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability has been found in code-projects Vehicle Showroom Management System 1.0. The affected element is an unknown function of the file /BranchManagement/ServiceAndSalesReport.php. The manipu…
|
CWE-79
CWE-94
Cross-site Scripting
Code Injection
|
CVE-2026-6035
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1596
|
7.3 |
HIGH
Network
|
-
|
-
|
A vulnerability was found in code-projects Vehicle Showroom Management System 1.0. The impacted element is an unknown function of the file /util/VehicleDetailsFunction.php. The manipulation of the ar…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6036
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1597
|
7.3 |
HIGH
Network
|
-
|
-
|
A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This affects an unknown function of the file /util/AddVehicleFunction.php. This manipulation of the argument BR…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6037
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1598
|
7.3 |
HIGH
Network
|
-
|
-
|
A vulnerability was identified in code-projects Vehicle Showroom Management System 1.0. This impacts an unknown function of the file /util/RegisterCustomerFunction.php. Such manipulation of the argum…
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-6038
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1599
|
3.3 |
LOW
Local
|
-
|
-
|
A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results …
|
CWE-404
CWE-407
Improper Resource Shutdown or Release
Inefficient Algorithmic Complexity
|
CVE-2026-6042
|
2026-04-25 03:01 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1600
|
7.1 |
HIGH
Network
|
-
|
-
|
The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plugin not properly verifying that a user is authorized to per…
|
CWE-862
Missing Authorization
|
CVE-2026-4162
|
2026-04-25 03:00 |
2026-04-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
