Search vulnerabilities

Expected end of text, found '\' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-56128

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

CVSS 4.0 · 5.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Netgate
Products
Pfsense Pfsense Ce Pfsense Plus
CVE-2026-56127

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.

CVSS 4.0 · 5.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Netgate
Products
Pfsense Pfsense Ce Pfsense Plus
CVE-2026-56126

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.

CVSS 4.0 · 5.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Netgate
Products
Pfsense Pfsense Ce Pfsense Plus
CVE-2026-43643

Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Softaculous
Products
Virtualizor
CVE-2026-43642

Softaculous Virtualizor PHP Object Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. Attackers can pass malicious serialized data through the billing_data POST field to the unserialize() function without allowed_classes restrictions, enabling exploitation of available POP chains to achieve remote code execution as root.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Softaculous
Products
Virtualizor
CVE-2026-43641

Softaculous Virtualizor OS Command Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.

CVSS 4.0 · 9.3 Critical EPSS 3.0% KEV · Not listed
Vendors
Softaculous
Products
Virtualizor
CVE-2026-101878

Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Bitwarden
Products
Bitwarden Server
CVE-2023-53964

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset Vulnerability

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 15 more
CVE-2023-53963

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

CVSS 4.0 · 9.3 Critical EPSS 3.4% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 15 more
CVE-2023-53962

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File Write

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through the 'upgfile' parameter in upload.cgi. Attackers can exploit the vulnerability by sending crafted multipart form-data POST requests with directory traversal sequences to write files to unintended system locations.

CVSS 4.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 15 more
CVE-2023-53961

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgery

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages that submit HTTP requests to the radio processing interface, triggering unintended administrative operations when a logged-in user visits the page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 15 more
CVE-2023-53960

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x SQL Injection via Authentication Bypass

SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access to the system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 15 more
CVE-2023-53955

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 15 more
CVE-2022-50796

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution.

CVSS 4.0 · 9.3 Critical EPSS 1.6% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 18 more
CVE-2022-50795

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious file and then deletes it after execution.

CVSS 4.0 · 8.5 High EPSS 4.2% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 18 more
CVE-2022-50794

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.

CVSS 4.0 · 9.3 Critical EPSS 3.7% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 18 more
CVE-2022-50793

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.php

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-handler.php script that allows attackers to inject system commands through the 'services' POST parameter. Attackers can exploit this vulnerability by crafting malicious 'services' parameter values to execute arbitrary system commands with www-data user privileges.

CVSS 4.0 · 8.7 High EPSS 3.1% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 18 more
CVE-2022-50792

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated File Disclosure Vulnerability

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive system files. Attackers can exploit the vulnerability by manipulating the 'file' GET parameter to disclose arbitrary files on the affected device.

CVSS 4.0 · 8.7 High EPSS 1.6% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 18 more
CVE-2022-50791

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.php

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the vulnerable ping.php script, which triggers the malicious file and then deletes it.

CVSS 4.0 · 8.5 High EPSS 3.8% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 18 more
CVE-2022-50790

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream Disclosure

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remote attackers to access live radio stream information through webplay or ffmpeg scripts. Attackers can exploit the vulnerability by calling specific web scripts to disclose radio stream details without requiring authentication.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sound4
Products
Big Voice2 Big Voice2 Firmware Big Voice4 and 18 more