Exploitées, pas encore au catalogue CISA
262 failles exploitées et pas encore officielles
Ces vulnérabilités ont des preuves publiques d'exploitation mais ne figurent pas encore au catalogue CISA. Elles ne portent pas d'échéance légale : elles portent des preuves. Quand CISA arrive, c'est en médiane 20 jours plus tard.
-
ahsay · ahsaycbs
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remo
Sources: huntress.com
-
ahsay · ahsaycbs
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remo
Sources: huntress.com
-
CVE-2026-4815 absente du catalogue CISA
schiocco · support_board
A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint.
Sources: socradar.io
-
CVE-2026-12227 absente du catalogue CISA
visualcomposer · visual_composer_website_builder
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execu
Sources: patchstack.com
-
CVE-2026-85097 absente du catalogue CISA
bricksforge · bricksforge
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attack
Sources: patchstack.com
-
CVE-2026-29058 vue par les capteurs absente du catalogue CISA
wwbn · avideo-encoder
AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration sec
Sources: api.vulncheck.com
-
CVE-2026-26216 Critique10.0 vue par les capteurs absente du catalogue CISA
kidocode · crawl4ai
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remot
Sources: api.vulncheck.com · previdian.com
-
CVE-2026-21589 absente du catalogue CISA
Atlassian · bamboo_data_center
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files
Sources: previdian.com
-
CVE-2026-102255 absente du catalogue CISA
SonicWall · SMA1000
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and
Sources: x.com · previdian.com · ess.coalitioninc.com
-
CVE-2026-94504 Élevée7.2 absente du catalogue CISA
kstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPres
Sources: patchstack.com
-
CVE-2026-93836 Élevée7.2 absente du catalogue CISA
wpclever · wpc_product_bundles_for_woocommerce
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arb
Sources: patchstack.com
-
CVE-2026-51886 Critique9.8 absente du catalogue CISA
Langflow · Langflow
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backe
Sources: previdian.com
-
CVE-2026-95675 Critique9.8 absente du catalogue CISA
D-Link · dap-1360_firmware
D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully com
Sources: previdian.com
-
CVE-2024-23625 absente du catalogue CISA
D-Link · dap-1650_firmware
A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
Sources: fortinet.com
-
CVE-2026-97359 Critique10.0 vue par les capteurs absente du catalogue CISA
Rejetto · hfs2
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting
Sources: api.vulncheck.com
-
CVE-2026-73382 Élevée7.1 absente du catalogue CISA
geminilabs · site_reviews
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.
Sources: cve.org
-
CVE-2026-65761 absente du catalogue CISA
joomshaper.com · Easy Store extension for Joomla
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.
Sources: previdian.com
-
CVE-2026-56005 Élevée7.1 absente du catalogue CISA
Melapress · wp_activity_log
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.
Sources: cve.org
-
CVE-2023-54405 Critique9.8 absente du catalogue CISA
H3C · CVM
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter witho
Sources: cve.org
-
CVE-2020-37278 Élevée7.5 absente du catalogue CISA
Weaver · e-Bridge
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such as /
Sources: cve.org
-
CVE-2014-125130 Élevée7.5 absente du catalogue CISA
Damjan · CodeArt Google MP3 Audio Player
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Att
Sources: cve.org
-
Rejetto · http_file_server
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's
Sources: api.vulncheck.com · linkedin.com
-
CVE-2025-3759 absente du catalogue CISA
Netis Systems · WF2220
Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but did
Sources: previdian.com
-
CVE-2025-11913 Moyenne4.3 absente du catalogue CISA
streamax · streamax_crocus
A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this vulnerability is the function Download of the file /Service.do?Action=Download. Such manipulation of the argument Path leads to path traversal. The attack can be launched remotely. The exploit has
Sources: vulncheck.com
-
CVE-2024-58388 Élevée7.5 absente du catalogue CISA
Sharp Corporation · Multiple Multifunction Printers
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequenc
Sources: cve.org
-
CVE-2021-36580 vue par les capteurs absente du catalogue CISA
icewarp · icewarp_server
Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.
Sources: dashboard.shadowserver.org
-
CVE-2024-58387 Élevée7.5 absente du catalogue CISA
Inspur · Haiyue HCM Cloud
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/fi
Sources: cve.org
-
CVE-2024-49766 Rançongiciel absente du catalogue CISA
palletsprojects · werkzeug
Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
Sources: zscaler.com
-
CVE-2023-54403 Élevée7.5 absente du catalogue CISA
Yonyou · U8 CRM
Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this fl
Sources: cve.org
-
CVE-2023-54402 Élevée7.5 absente du catalogue CISA
iDocView · iDocView
iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling
Sources: cve.org
-
CVE-2020-22209 vue par les capteurs absente du catalogue CISA
74cms · 74cms
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
Sources: dashboard.shadowserver.org
-
CVE-2026-85520 absente du catalogue CISA
MyPresta · Google Merchant Center Feed
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the la
Sources: cve.org
-
CVE-2025-62023 Critique9.0 absente du catalogue CISA
s2member · s2member
Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.
Sources: patchstack.com
-
CVE-2023-54400 absente du catalogue CISA
Fumasoft · Fumeng Cloud
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniqu
Sources: cve.org
-
CVE-2018-8033 vue par les capteurs absente du catalogue CISA
Apache · OFBiz
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMo
Sources: dashboard.shadowserver.org
-
CVE-2015-20122 absente du catalogue CISA
Yonyou · A6 OA
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject UNION
Sources: cve.org
-
CVE-2026-18143 Critique9.8 absente du catalogue CISA
Addify · Request a Quote for WooCommerce
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the ra
Sources: patchstack.com
-
CVE-2026-100382 absente du catalogue CISA
Wikimedia Foundation · Mediawiki - ExternalData Extension
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.
Sources: lists.wikimedia.org
-
CVE-2025-9090 vue par les capteurs absente du catalogue CISA
Tenda · ac20_firmware
A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and ma
Sources: linkedin.com · api.vulncheck.com
-
CVE-2024-5522 vue par les capteurs absente du catalogue CISA
bplugins · html5_video_player
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Sources: dashboard.shadowserver.org
-
CVE-2026-33057 vue par les capteurs absente du catalogue CISA
mesop-dev · mesop
Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard Unres
Sources: api.vulncheck.com
-
CVE-2026-93622 absente du catalogue CISA
NicolasKulka · WPS Limit Login
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
Sources: patchstack.com
-
CVE-2026-93399 Critique9.1 absente du catalogue CISA
ladela · Online Scheduling and Appointment Booking System – Bookly
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly
Sources: patchstack.com
-
CVE-2026-88996 Moyenne6.1 absente du catalogue CISA
smub · WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input s
Sources: patchstack.com
-
CVE-2026-62062 Élevée8.8 absente du catalogue CISA
elementor · Website Builder
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.
Sources: patchstack.com
-
CVE-2026-42608 Critique9.1 absente du catalogue CISA
getgrav · grav
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories
Sources: bleepingcomputer.com
-
CVE-2026-30633 vue par les capteurs absente du catalogue CISA
knowns-dev · knowns
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools.
Sources: api.vulncheck.com · linkedin.com
-
CVE-2026-18322 Élevée8.8 absente du catalogue CISA
supsysticcom · Smart Popup by Supsystic
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` overwrites the popup module's administrato
Sources: labs.itresit.es
-
CVE-2022-28368 absente du catalogue CISA
dompdf_project · dompdf
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
Sources: socradar.io
-
CVE-2026-75949 absente du catalogue CISA
cmsjunkie.com · J-BusinessDirectory extension for Joomla
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF t
Sources: previdian.com
-
CVE-2026-66457 Élevée7.1 absente du catalogue CISA
pixelite · events_manager
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
Sources: cve.org
-
CVE-2025-68472 vue par les capteurs absente du catalogue CISA
mindsdb · mindsdb
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT h
Sources: api.vulncheck.com
-
CVE-2016-20080 vue par les capteurs absente du catalogue CISA
Brandfolder · Brandfolder
WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_ab
Sources: dashboard.shadowserver.org
-
CVE-2026-92229 Critique9.1 absente du catalogue CISA
wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before
Sources: patchstack.com
-
CVE-2026-88062 vue par les capteurs absente du catalogue CISA
diegosouzapw · OmniRoute
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before execFileSyn
Sources: api.vulncheck.com · dashboard.shadowserver.org
-
iguazio · nuclio
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the
Sources: greynoise.io
-
FlowiseAI · Flowise
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/i
Sources: greynoise.io
-
senaite · senaite.core
SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in sr
Sources: greynoise.io
-
Roundcube · Webmail
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Sources: ess.coalitioninc.com · cyber.gc.ca
-
CVE-2026-27960 Critique9.8 vue par les capteurs absente du catalogue CISA
citeum · opencti
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin a
Sources: dashboard.shadowserver.org
-
CVE-2021-30134 vue par les capteurs absente du catalogue CISA
php_curl_class_project · php_curl_class
php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.
Sources: dashboard.shadowserver.org
-
CVE-2018-13980 vue par les capteurs absente du catalogue CISA
zeta-producer · zeta_producer
The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal.
Sources: dashboard.shadowserver.org
-
CVE-2026-86124 Critique9.8 vue par les capteurs absente du catalogue CISA
HKUDS · AutoAgent
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access t
Sources: api.vulncheck.com
-
CVE-2026-84434 Critique9.8 absente du catalogue CISA
Gravity Forms · Gravity Forms
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extensio
Sources: patchstack.com
-
CVE-2026-42796 vue par les capteurs absente du catalogue CISA
workiva · arelle
Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file throu
Sources: dashboard.shadowserver.org
-
CVE-2023-46359 vue par les capteurs absente du catalogue CISA
hardy-barth · cph2_echarge_firmware
An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.
Sources: dashboard.shadowserver.org
-
CVE-2023-29827 vue par les capteurs absente du catalogue CISA
ejs · ejs
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untr
Sources: dashboard.shadowserver.org
-
CVE-2017-20284 Élevée7.5 vue par les capteurs absente du catalogue CISA
Caucho Technology, Inc. · Resin
Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests
Sources: dashboard.shadowserver.org · previdian.com · cve.org
-
CVE-2026-89013 Élevée7.5 absente du catalogue CISA
dolibarr · dolibarr_erp\/crm
Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation whil
Sources: previdian.com
-
CVE-2026-86538 Élevée7.5 absente du catalogue CISA
knowns-dev · knowns
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensit
Sources: previdian.com
-
CVE-2026-40242 vue par les capteurs absente du catalogue CISA
getarcane · arcane
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. T
Sources: dashboard.shadowserver.org
-
CVE-2026-32255 vue par les capteurs absente du catalogue CISA
kan · kan
Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the
Sources: dashboard.shadowserver.org
-
CVE-2022-45362 vue par les capteurs absente du catalogue CISA
paytm · payment_gateway
Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.
Sources: dashboard.shadowserver.org
-
CVE-2022-25497 absente du catalogue CISA
cuppacms · cuppacms
CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
Sources: previdian.com
-
CVE-2026-66047 Élevée8.1 absente du catalogue CISA
Proper Fraction · ProfilePress
ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attac
Sources: patchstack.com
-
CVE-2026-54196 Moyenne6.8 absente du catalogue CISA
Crocoblock · jetformbuilder
Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.
Sources: patchstack.com
-
CVE-2026-50752 Rançongiciel absente du catalogue CISA
checkpoint · Quantum Security Gateway
A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could allow
Sources: s2w.inc · medium.com
-
CVE-2026-32996 absente du catalogue CISA
Veeam · veeam_backup_\&_replication
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
Sources: arcticwolf.com
-
CVE-2022-0412 vue par les capteurs absente du catalogue CISA
templateinvaders · ti_woocommerce_wishlist
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL
Sources: dashboard.shadowserver.org
-
Issabel Foundation · Issabel Framework
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can
Sources: dashboard.shadowserver.org · cve.org
Pourquoi une page distincte
Données issues du catalogue Known Exploited Vulnerabilities de la CISA, œuvre du gouvernement américain dans le domaine public. Les échéances indiquées s’imposent aux agences fédérales américaines (BOD 22-01) ; pour les autres, elles constituent une bonne référence de priorité.
Données d'exploitation : VulnCheck KEV. Le catalogue des vulnérabilités activement exploitées est celui de CISA.