2026-05-30 归档

今日共收录 1277 条安全情报，包含 517 个 CVE，386 篇安全通告，以及 105 篇研究论文。

漏洞预警2026-05-29 发布INFO

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers ca...

CVE-2018-25397

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administra

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-29 发布INFO

Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administrative credentials by accessing the networ...

CVE-2018-25396

Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to re

历史摘要 · 未重新核验 · NVD

#cve #cwe-256

漏洞预警2026-05-29 发布INFO

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the feature...

CVE-2018-25395

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQ

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-29 发布INFO

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the release...

CVE-2018-25394

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQ

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-29 发布INFO

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by injecting directory traversal sequences in the id param...

CVE-2018-25393

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files b

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-29 发布INFO

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters...

CVE-2018-25392

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-29 发布INFO

HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that sp...

CVE-2018-25391

HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to dele

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-29 发布INFO

HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter...

CVE-2018-25390

HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database querie

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-29 发布INFO

HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST ...

CVE-2018-25389

HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database querie

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-29 发布INFO

HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can uploa...

CVE-2018-25388

HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-05-29 发布INFO

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoin...

CVE-2018-25387

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-29 发布INFO

HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries by injecting SQL code through the 'id' parame...

CVE-2018-25386

HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate datab

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-29 发布INFO

E-Registrasi Pencak Silat 18.10 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throug...

CVE-2018-25385

E-Registrasi Pencak Silat 18.10 contains an SQL injection vulnerability that allows unauthenticated attackers to execute

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-29 发布INFO

Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted HTML in the reply_text parame...

CVE-2018-25384

Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-29 发布INFO

Free MP3 CD Ripper 2.8 contains a stack-based buffer overflow vulnerability in WMA file processing that allows local attackers to bypass DEP protection via structured exception ...

CVE-2018-25383

Free MP3 CD Ripper 2.8 contains a stack-based buffer overflow vulnerability in WMA file processing that allows local att

历史摘要 · 未重新核验 · NVD

#cve #cwe-121

漏洞预警2026-05-29 发布INFO

Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the uname parameter. Attac...

CVE-2018-25382

Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-29 发布INFO

mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSR...

CVE-2026-45609

mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mc

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-29 发布INFO

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows inje...

CVE-2026-41159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-29 发布INFO

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when ren...

CVE-2026-41150

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-05-29 发布INFO

Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows remote attackers to upload arbitrary ...

CVE-2026-39292

Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder

历史摘要 · 未重新核验 · NVD

#cve