#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-22 发布HIGH

i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries th...

CVE-2024-58393

i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows un

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布MEDIUM

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplyi...

CVE-2023-54413

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that all

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename pa...

CVE-2022-51024

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitr

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can s...

CVE-2022-51023

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布CRITICAL

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to r...

CVE-2022-51022

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /ad

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers...

CVE-2021-48017

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in t

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布CRITICAL

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthentic...

CVE-2021-48016

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is wri

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-22 发布HIGH

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers ca...

CVE-2021-48015

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to re

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownl...

CVE-2021-48013

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary file

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /con...

CVE-2020-37284

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attacker

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. ...

CVE-2019-25779

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitra

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter....

CVE-2018-25439

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipu...

CVE-2018-25438

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email param...

CVE-2017-20290

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenti

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布MEDIUM

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path paramete...

CVE-2017-20288

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfr...

CVE-2017-20287

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-...

CVE-2026-114348

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 bef

来源摘录 · NVD

#cve #cwe-1289 #cwe-209

漏洞预警2026-10-22 发布HIGH

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to ...

CVE-2026-112085

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 a

来源摘录 · NVD

#cve #cwe-1385 #cwe-346

漏洞预警2026-10-22 发布INFO

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erla...

CVE-2026-93471

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthentic

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-22 发布INFO

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the...

CVE-2026-86696

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated a

来源摘录 · NVD

#cve #cwe-770