Export limit exceeded: 94311 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94311 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85660 | 1 Mladensu | 1 Cli-mcp-server | 2026-09-07 | 8.1 High |
| cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check. | ||||
| CVE-2026-85672 | 1 Getomni-ai | 1 Zerox | 2026-09-07 | 9.8 Critical |
| zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occurs. | ||||
| CVE-2026-77847 | 1 Tycon Systems | 1 Tpdin-monitor-web3 | 2026-09-07 | 6.5 Medium |
| Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials. | ||||
| CVE-2026-15984 | 2 Themovation, Wordpress | 2 Quickcal, Wordpress | 2026-09-07 | 7.2 High |
| The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege. | ||||
| CVE-2026-78327 | 1 Sonicwall | 1 Network Security Manager | 2026-09-07 | 9.1 Critical |
| An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution. | ||||
| CVE-2025-15694 | 2 Wordpress, Wpjoli | 2 Wordpress, Joli Table Of Contents | 2026-09-07 | 3.5 Low |
| The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup. | ||||
| CVE-2026-82846 | 2 Masteriyo, Wordpress | 2 Masteriyo, Wordpress | 2026-09-07 | 6.8 Medium |
| The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator. | ||||
| CVE-2026-84931 | 2 Wordpress, Wpjoli | 2 Wordpress, Joli Table Of Contents | 2026-09-07 | 6.8 Medium |
| The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML. | ||||
| CVE-2026-84934 | 2 Jch Optimize Project, Wordpress | 2 Jch Optimize, Wordpress | 2026-09-07 | 8 High |
| The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site. | ||||
| CVE-2026-2670 | 1 Advantech | 14 Wise-6610, Wise-6610-cb, Wise-6610-eb and 11 more | 2026-09-07 | 7.2 High |
| A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data." | ||||
| CVE-2026-86221 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-09-06 | 7.3 High |
| A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. | ||||
| CVE-2026-80439 | 2 Redirection-for-contact-form7, Wordpress | 2 Redirection For Contact Form 7, Wordpress | 2026-09-06 | 4.8 Medium |
| The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output. | ||||
| CVE-2026-80437 | 2 Ninjaforms, Wordpress | 2 Ninja Forms, Wordpress | 2026-09-06 | 4.8 Medium |
| The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. | ||||
| CVE-2026-84935 | 2026-09-06 | 8 High | ||
| The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu. | ||||
| CVE-2026-84930 | 2026-09-06 | 6.8 Medium | ||
| The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post. | ||||
| CVE-2026-84899 | 2026-09-06 | 6.8 Medium | ||
| The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission. | ||||
| CVE-2026-84896 | 2026-09-06 | 6.8 Medium | ||
| The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators. | ||||
| CVE-2026-84219 | 2 Kirki, Wordpress | 2 Kirki, Wordpress | 2026-09-06 | 7.5 High |
| The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments. | ||||
| CVE-2026-84028 | 2026-09-06 | 6.8 Medium | ||
| The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page. | ||||
| CVE-2026-84022 | 2026-09-06 | 6.8 Medium | ||
| The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page. | ||||