aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
CVE-2026-86668
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function u
2026-09-09 归档
今日共收录 1483 条安全情报，包含 593 个 CVE，506 篇安全通告，以及 97 篇研究论文。
← 返回归档列表aircheng-org iWebShop-5 member.php member_list sql injection
CVE-2026-86667
A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list o
aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload
CVE-2026-86666
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFi
Snipe-IT before 8.7.0 CSS Injection via Custom CSS
CVE-2026-86738
Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitizat
snipe-it before 8.7.0 Missing Authorization via barcode endpoint
CVE-2026-86737
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. A
snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
CVE-2026-86736
snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authentic
Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
CVE-2026-86734
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint,
Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore
CVE-2026-86733
Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line
Craft CMS before 5.10.12 Remote Code Execution via element-index
CVE-2026-86732
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allow
Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController
CVE-2026-86731
Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (t
Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
CVE-2026-86730
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated co
AVideo through 29.0 Unauthenticated Disclosure via epg.json.php
CVE-2026-86728
AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-s
AVideo through 29.0 Information Disclosure via stats.json.php
CVE-2026-86727
AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthent
aircheng-org iWebShop-5 update.php index authorization
CVE-2026-86665
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of t
star7th showdoc API Page Save Endpoint editormd.js cross site scripting
CVE-2026-86644
A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_s
fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address
CVE-2026-75021
fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user su
CVE-2026-12611
CVE-2026-12611
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually
CVE-2026-19203
CVE-2026-19203
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary pr
PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman
CVE-2026-86714
PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to
PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
CVE-2026-86713
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_c