SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin...
CVE-2025-69948
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.
#advisory
共收录 23634 条相关情报。
← 返回所有主题SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php...
CVE-2025-69946
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters distr
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...
CVE-2026-38711
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd
CVE-2026-18321
Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd
free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure
CVE-2026-53551
### Summary The free5GC AUSF (Authentication Server Function) does not validate the `supiOrSuci` field in UE authentica
zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit
### Summary `NonFinalizedState::handle_reorg` is a recursive, unbounded async function that traverses parent blocks unti
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
CVE-2026-52887
## Summary `GET /api/myInAppChannels:list` accepts a structured `filter` query parameter. The handler for the `latestMs
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
CVE-2026-53599
## Summary `rex_mediapool::isAllowedExtension` in `redaxo/src/addons/mediapool/lib/mediapool.php` accepts filenames th
ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow
CVE-2026-53466
An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can res
Savon::Model evaluates WSDL operation names as Ruby source
CVE-2026-53510
### Impact `Savon::Model` generated SOAP operation methods by interpolating operation names into Ruby source passed to
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
CVE-2026-65841
A `` element placed directly inside an `` (or MathML) container was not removed by Jodit's clean-html sanitizer. The de
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
CVE-2026-58263
### Summary jodit's built-in `clean-html` sanitizer can be bypassed by a MathML/`` carrier that hides a dangerous elemen
Jodit has prototype pollution via Jodit.configure() / ConfigMerge
CVE-2026-54756
### Summary `Jodit.configure(options)` — and the internal `ConfigMerge` / `ConfigProto` helpers — merged user-supplied o
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
CVE-2026-62324
### Summary jodit's `sanitizeHTMLElement` neutralizes a `javascript:` `href` using a bare `href.trim().indexOf('javascr
Contao crawler leaks auth credentials to external hosts
CVE-2026-55824
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth cre
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
CVE-2026-53502
The file_loader performs `unquote()` on the file path AFTER the `abspath() + startswith()` security check. An attacker c
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
CVE-2026-53502
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
CVE-2026-53505
### Summary Thumbor's `filters:proportion()` filter does not enforce an upper bound on `` and runs in the post-transform
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
CVE-2026-53505
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion() filter do
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
CVE-2026-53504
### Summary The regular expression used to parse the `convolution` filter exhibits exponential-time backtracking for cer