Search vulnerabilities

Expected end of text, found '‑' (at char 7), (line:1, col:8)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,850

CVE-2025-2609

MagnusBilling Stored Cross-Site Scripting in Login Logs

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0.

CVSS 3.1 · 8.2 High EPSS 1.2% KEV · Not listed
Vendors
Magnussolution
Products
Magnusbilling
CVE-2026-77991

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Joomlaeventmanager.net
Products
Jem - Joomla Event Manager Extension For Joomla
CVE-2026-17562

IDOR in Zirve Security's AdisyonPro

Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Summit Security Systems
Products
Adisyonpro
CVE-2026-5218

HTML Injection in Softtr's E-Commerce Pack

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Softtr Informatics Technology Trading Limited Company
Products
E-commerce Pack
CVE-2026-81672

Multiple Vulnerabilities in TOOOLS' iSquad

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework’s error handler, which increases the severity due to the combination of information disclosure and SQL injection.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Toools
Products
Isquad
CVE-2026-66155

Cross‑Site Scripting via Unescaped Tooltip Label in Siemens Element maps‑ng

A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Element Maps-ng V47 Element Maps-ng V48 Element Maps-ng V49
CVE-2026-81673

Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Toools
Products
Isquad
CVE-2026-81674

Multiple Vulnerabilities in TOOOLS' iSquad

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Toools
Products
Isquad
CVE-2026-81675

Multiple Vulnerabilities in TOOOLS' iSquad

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Toools
Products
Isquad
CVE-2026-81676

Multiple Vulnerabilities in TOOOLS' iSquad

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Toools
Products
Isquad
CVE-2026-81677

Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Toools
Products
Isquad
CVE-2026-56652

Formula Injection in dool project

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application.  The issue was addressed by pull request #117

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Scottchiefbaker
Products
Dool
CVE-2026-56651

Arbitrary File Overwrite via Symlink Following in dool project

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Scottchiefbaker
Products
Dool