2026-07-02 归档

今日共收录 1714 条安全情报，包含 914 个 CVE，384 篇安全通告，以及 113 篇研究论文。

漏洞预警2026-07-01 发布INFO

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including,...

CVE-2026-13228

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Esca

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-01 发布INFO

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all versions up to, and in...

CVE-2026-12142

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to ins...

CVE-2026-10095

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woffice: from n/a before 5....

CVE-2026-27435

Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Securit

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-01 发布INFO

The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5 due to insufficie...

CVE-2026-13454

The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in a

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-01 发布INFO

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and includi...

CVE-2026-12754

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of...

CVE-2026-56016

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The gene

历史摘要 · 未重新核验 · NVD

#cve #cwe-338 #cwe-340

漏洞预警2026-07-01 发布INFO

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-A100/MB-A110. If this vulnerability is exploited, an arbi...

CVE-2026-50043

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-01 发布INFO

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to ...

CVE-2026-13733

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attri

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and including, 4.4.0. This i...

CVE-2026-12732

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-01 发布INFO

DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.

CVE-2026-12577

DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.

历史摘要 · 未重新核验 · NVD

#cve #cwe-358

漏洞预警2026-07-01 发布INFO

DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.

CVE-2026-12576

DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.

历史摘要 · 未重新核验 · NVD

#cve #cwe-924

漏洞预警2026-07-01 发布INFO

DVP80ES3 with Improper Resource Shutdown or Release vulnerability.

CVE-2026-12575

DVP80ES3 with Improper Resource Shutdown or Release vulnerability.

历史摘要 · 未重新核验 · NVD

#cve #cwe-404

漏洞预警2026-07-01 发布INFO

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to...

CVE-2026-12435

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-01 发布INFO

The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4....

CVE-2026-12408

The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Co

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-01 发布INFO

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the `...

CVE-2026-12224

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-01 发布INFO

The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is du...

CVE-2026-12158

The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-07-01 发布INFO

The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtai...

CVE-2026-10540

The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offl

历史摘要 · 未重新核验 · NVD

#cve #cwe-328

漏洞预警2026-07-01 发布INFO

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and...

CVE-2026-10538

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowe

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter due to missing valid...

CVE-2026-10096

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin

历史摘要 · 未重新核验 · NVD

#cve #cwe-639