Export limit exceeded: 424797 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95165 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105484 | 1 Totolink | 2 X6000r, X6000r Firmware | 2026-10-06 | 10 Critical |
| A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote. | ||||
| CVE-2026-105471 | 1 Girishsaraf | 1 Online-appointment-booking-system | 2026-10-06 | 7.3 High |
| A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-105388 | 1 Feelec-yishu | 1 Feelcrm-os | 2026-10-06 | 6.3 Medium |
| A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument group_id causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-105807 | 1 Sourcecodester | 1 Simple Student Information System | 2026-10-06 | 7.3 High |
| A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely. | ||||
| CVE-2026-105776 | 1 Bhagya3929 | 1 Employee-movement-tracking-and-monitoring-website-for-iocl | 2026-10-06 | 7.3 High |
| A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-105708 | 1 Imgproxy | 1 Imgproxy | 2026-10-06 | 4.3 Medium |
| A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-105487 | 1 Yogeshojha | 1 Rengine | 2026-10-06 | 6.3 Medium |
| A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-105809 | 1 Sourcecodester | 1 Simple Student Information System | 2026-10-06 | 4.3 Medium |
| A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-39760 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. | ||||
| CVE-2026-39750 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions. | ||||
| CVE-2026-39748 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions. | ||||
| CVE-2026-39745 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions. | ||||
| CVE-2026-39731 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions. | ||||
| CVE-2026-39724 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions. | ||||
| CVE-2026-39722 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions. | ||||
| CVE-2026-39720 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions. | ||||
| CVE-2026-32577 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions. | ||||
| CVE-2026-32575 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions. | ||||
| CVE-2026-32572 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions. | ||||
| CVE-2026-32571 | 2026-10-06 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions. | ||||