CVEs added in
April 2026

SQL Injection in SourceCodester Pharmacy Sales and

SQL Injection in delete_customer Endpoint of Pharmacy Sales

OS Command Injection in Totolink NR1800X cstecgi.cgi

SQL Injection in checkEmail Endpoint of SourceCodester

OS Command Injection in Totolink A8000RU CGI Handler

SQL Injection in Hotel Management System Reservation Check

Improper Authorization in GoClaw and GoClaw Lite

OS Command Injection in HKUDS OpenHarness /bridge Slash

SQL Injection in SSCMS stl:sqlContent Tag

Auth bypass via URL dot-segment handling in Traefik

Authentication Bypass / Identity Spoofing in Traefik

Denial of Service via Improper Input Validation

OS Command Injection in Amazon ECS Agent FSx Windows File

Improper Access Control in Chartbrew Project Dataset and

Missing Authorization in Chartbrew Chart Query Endpoint

Broken Access Control / IDOR in Chartbrew SharePolicy

Improper Access Control in Chartbrew Public Chart Retrieval

XML External Entity (XXE) in SpringBlade loadReport Endpoint

Path Traversal in JeeSite upload Endpoint

Path Traversal in Shopizer add File Upload Endpoint

Path Traversal in JeeSite upload Endpoint

OS Command Injection in Synway SMG Gateway RADIUS

CSRF in U-SPEED N300 Router Web Management Interface

Code Injection in Krayin CRM Compose Email Function

Improper Brute-Force Protection in U-SPEED N300 Router

CSRF in Dbit N300 T1 Pro Router Web Management Interface

Command Injection in Pallets Click click.edit() Helper

Missing Authentication for Critical Function in django-mdedi

Improper Access Control in 1024-lab Smart-Admin Demo Druid

OS Command Injection in mcp-server-semgrep MCP Interface

OS Command Injection in mcp-dnstwist MCP Interface

SSRF in Algovate xhs-mcp MCP Interface

OS Command Injection in PolarVista xcode-mcp-server MCP

Path Traversal in mcpo-simple-server delete_shared_prompt

Path Traversal in filesystem-mcp-server read/write Tools

Code Injection in Cockpit CMS Collection Rules Handling

Arbitrary Code Execution in AgentFlow API

Path Traversal in BioinfoMCP Upload Endpoint

Path Traversal / Arbitrary File Write in Wazuh

Command Injection in DocsGPT MCP Test Handling

Path Traversal in mail-mcp-bridge Message Handling

Authentication Bypass in cPanel & WHM Login Flow

Unrestricted File Upload / Type Bypass in Cockpit Bucket

Privilege Escalation via Vulnerable Kernel Driver IOCTL

Path Traversal in mcp-bases research_server search_papers

Code Injection in Cockpit filter Parameter

OS Command Injection in TOTOLINK N200RE V5 formMapDelDevice

XSS in GCHQ CyberChef Show Base64 Offsets

HTTP Request Smuggling in Starman Due to Improper Header

SQL Injection in ProFTPD mod_sql

Path Traversal in elinsky execution-system-mcp add_action

Command Injection in aider-mcp code_with_ai Component

Path Traversal in Spire PDF MCP Server PDF File Handler

Path Traversal in Spire Doc MCP Server get_doc_path Handler

Insecure Direct Object Reference (IDOR) in Outline

Missing Authorization in OpenClaw Node Reconnection Flow

Authorization Bypass in OpenClaw Persistent Browser Profile

Improper Authorization in OpenClaw Gateway HTTP

Improper Authorization in OpenClaw node.pair.approve

Authorization Bypass / Improper Authorization

SSRF in OpenClaw QQ Bot Media Download Paths

SSRF in OpenClaw Navigation Handling

Improper Authorization in OpenClaw Trusted-Proxy Mode

Missing Authorization in OpenClaw

Path Traversal / Arbitrary File System Access

Missing Authorization in OpenClaw Talk Voice Configuration

Missing Authorization in OpenClaw Node-Gateway Channel

Missing Authentication for Critical Functions

XSS in HTMLy Image Content Creation Endpoint

Unsafe Deserialization in StellarGroup HPX 1.11.0

Code Injection in OpenCATS Installer AJAX Endpoint

Path Traversal in matlab-mcp-server MCP Interface Code

OS Command Injection in Totolink A8000RU CGI Wi-Fi Guest

OS Command Injection in Totolink A8000RU setRadvdCfg CGI

OS Command Injection in Totolink A8000RU CGI Handler

OS Command Injection in Totolink A8000RU CGI Wi-Fi

OS Command Injection in Totolink A8000RU CGI VPN Account

Path Traversal in AgiFlow scaffold-mcp write-to-file Tool

Path Traversal in BrowserOperator browser-operator-core

SQL Injection in Pizzafy Ecommerce System get_cart_count

SQL Injection in Login Endpoint of Pizzafy Ecommerce System

SQL Injection in SourceCodester Pizzafy Ecommerce System

SQL Injection in delete_menu Endpoint of Pizzafy Ecommerce

SQL Injection in delete_cart Endpoint of Pizzafy Ecommerce

SSRF in HyperChat AI Proxy Middleware

SSRF in CloudBase-MCP open-url API Endpoint

OS Command Injection in FastlyMCP fastly_cli Tool

Path Traversal in processing-claude-mcp-bridge

Command Injection in gmx-vmd-mcp VMD Launch Handler

Path Traversal in engineer-your-data File Operations

Path Traversal in MLOps_MCP save_file Tool

Path Traversal in notes-mcp notes_mcp.py Root Directory

Command Injection in dvladimirov MCP GitSearchRequest

SQL Injection in dubydu sqlite-mcp extract_to_json

Path Traversal in duartium papers-mcp-server search_papers

OS Command Injection in Totolink A8000RU CGI

OS Command Injection in Totolink A8000RU CGI URL Filter

OS Command Injection in Totolink A8000RU CGI Handler

SQL Injection in Pharmacy Sales and Inventory System

Broken Access Control / Incorrect Authorization

Hard-Coded Credentials in Milesight AIoT Camera Firmware

SQL Injection in SourceCodester Pharmacy Sales and

Broken Authorization / Insecure Direct Object Reference

SSRF in ChatGPTNextWeb NextChat Artifacts Endpoint

SSRF in ChatGPTNextWeb NextChat proxyHandler

Path Traversal in douinc mkdocs-mcp-plugin server document

Code Injection in qnabot-on-aws Content Designer

SSRF in mcp-url-downloader URL Validation

Command Injection in aider_mcp_server aider_ai_code

OS Command Injection in Totolink A8000RU CGI Handler

OS Command Injection in Totolink A8000RU CGI Login Password

OS Command Injection in Totolink A8000RU CGI Handler

Path Traversal in Windows via shutil.unpack_archive ZIP

SQL Injection in NASA EOSDIS MODAPS Category Parameter

OS Command Injection in Totolink A8000RU CGI Handler

OS Command Injection in Totolink A8000RU Telnet

Path Traversal in kaggle-mcp prepare_kaggle_dataset Endpoint

SSRF in mcp-chat-studio LLM Models API

Improper Authentication in MERCURY MIPC252W IP Camera RTSP

Command Injection in Tenda AC18 SetSambaCfg Interface

SSRF in mcp-data-vis HTTP Request Handler

Improper Privilege Management in Fan Control Open File

OS Command Injection in Totolink A8000RU CGI Handler

OS Command Injection in Totolink A8000RU setWiFiAclRules

CSRF in Diskover Community settings_process.php

OS Command Injection in Totolink A8000RU setNtpCfg CGI

OS Command Injection in Totolink A8000RU CGI setStorageCfg

OS Command Injection in Totolink A8000RU setDmzCfg CGI

OS Command Injection in autocoder start Endpoint

Path Traversal in Autocoder UI/static Component

SQL Injection in Online Lot Reservation System

SQL Injection in delete_category Endpoint of Pharmacy Sales

SQL Injection in SourceCodester Pharmacy Sales and

SQL Injection in SourceCodester Pharmacy Sales and

SQL Injection in SourceCodester Pharmacy Sales and

OS Command Injection in Totolink A8000RU CGI Handler

OS Command Injection in Totolink A8000RU setIpv6LanCfg CGI

OS Command Injection in Totolink A8000RU CGI Handler

OS Command Injection in Totolink A8000RU CGI UPnP

OS Command Injection in Totolink A8000RU CGI Wizard

SSRF in ShadowCloneLabs GlutamateMCPServers

SQL Injection in SourceCodester Pharmacy Sales and

SQL Injection in SourceCodester Pharmacy Sales and

SQL Injection in Courier Management System /edit_parcel.php

SQL Injection in Courier Management System /edit_branch.php

SQL Injection in Construction Management System

SQL Injection in itsourcecode Construction Management

SQL Injection in itsourcecode Construction Management

SQL Injection in CodePanda Canteen Management System

SQL Injection in Login Component of Inventory Management

OS Command Injection in simple-openstack-mcp exec_openstack

SSRF in BuildingAI Remote Upload API

OS Command Injection in AgentDeskAI browser-tools-mcp

SQL Injection in Employee Management System Endpoint

OS Command Injection in Intina47 Context-Sync Git

OS Command Injection in Toowiredd chatgpt-mcp-server

SQL Injection in yu-picture MyBatis-Plus Service

Command Injection in MiroFish Inter-Process Communication

Missing Authentication in MiroFish REST API Endpoint

OS Command Injection in ssh-mcp

OS Command Injection in Totolink A8000RU CGI Handler

Path Traversal in Tenda i9 HTTP

SSRF in Typecho Pingback Service Endpoint

Improper Authentication in SmythOS sre HTTP Header Handler

OS Command Injection in Linksys MR9600 JNAP Action Handler

Command Injection in PicoClaw restart

Command Injection in GitPilot-MCP repo_path Function

Improper Authorization in Vanna Legacy Flask API

Code Injection via Argument/Option Injection in simple-git

SQL Injection in Saltcorn Mobile-Sync Routes

Authentication Bypass / Missing Authentication

Route Matching and Authorization Bypass in Clerk Framework

Missing Authentication for Critical Functionality

Path Traversal and Insecure File Handling in OpenTelemetry

Improper Authentication / Authorization in Budibase

Information Exposure in Dgraph Alpha vars

Cross-Site Scripting (XSS) Leading to Code Execution

Path Traversal / Local File Inclusion in 4ga Boards Archive

Code Injection / Untrusted CI Execution in Skim GitHub

Server-Side Request Forgery (SSRF) / Proxy Bypass

HTTP Header Injection / Response Splitting in Axios HTTP

Path Traversal in Poetry sdist Extraction (CWE-22)

XML External Entity (XXE) in Python lxml Parsers

Authentication and Authorization Bypass in CodeChecker Web

Server-Side Request Forgery and Sensitive Token Exposure

Improper Authorization in Kyverno ConfigMap Context Loader

Cross-Site Request Forgery (CSRF) in Frappe Press

Guard Bypass in ERB Deserialization (CWE-502/693)

Missing Authorization / Broken Access Control

OS Command Injection in Roxy-WI find-in-config Endpoint

SQL Injection in Roxy-WI haproxy_section_save server_ip

Path Traversal in Roxy-WI haproxy_section_save Interface

Path Traversal in Roxy-WI haproxy_section_save Interface

Authorization Bypass in Kirby CMS Content Creation

XML Injection in Kirby Xml::value() Utility Methods

Missing Authorization / Access Control in SenseLive X3050

Missing Authentication for Critical Function in SenseLive

Improper Credential Management in SenseLive X3050 Web

Broken Authentication / Hardcoded Credentials

Missing Authentication in SenseLive X3050 Management

SQL Injection in Xibo CMS DataSet Filtering API

Missing Authentication for Critical Functions

CSRF in SenseLive X3050 Web Management Interface

Missing Authentication in SenseLive X3050

Server-Side Request Forgery (SSRF) Protection Bypass

Privilege Escalation / Improper Privilege Management

Missing Authorization in OpenClaw

Missing Authorization / Consent Bypass in OpenClaw Agent

CSRF in OpenClaw HTTP Operator Endpoints

Unsafe Deserialization in KTransformers balance_serve RPC

OS Command Injection in radare2-mcp JSON-RPC Command

Path Traversal in radare2

Broken Access Control / Insecure Direct Object Reference

Information Exposure in Flowise Public Chatflows

Mass Assignment / Broken Object-Level Authorization

Authentication Bypass in Flowise AccountService

Cleartext Transmission of Sensitive Information

Missing Authentication / Authorization in Flowise Public

SSRF in Flowise Core Security Wrappers

SSRF in Flowise API Chain Components

SSRF in Flowise Custom Function Sandbox

Unrestricted File Upload in Flowise Chatflow Configuration

Improper Input Validation / Remote Code Execution

Improper Mass Assignment / JSON Injection in Flowise Cloud

Sensitive Information Exposure in Flowise

Command Injection in Flowise Airtable Agents

Code Injection in Flowise AirtableAgent

Code Injection in Flowise

Unsafe Deserialization in LeRobot Async Inference gRPC

Path Traversal (CWE-35) in Intrado 911 Emergency Gateway Debug Log Download

OS Command Injection in elFinder ImageMagick Resize Backend

Code Injection in Contour Cookie Rewriting for Envoy

XSS in pretalx Organiser Search Backend

Path Traversal in Mako TemplateLookup.get_template()

OS Command Injection in ToToLink A3300R cstecgi.cgi

OS Command Injection in ToToLink A3300R STUN Configuration

OS Command Injection in ToToLink A3300R STUN Configuration

OS Command Injection in ToToLink A3300R STUN Configuration

Code Injection in ntfy.sh Notification Server

.NET Remoting / Insecure Remote Method Invocation

Unsafe Deserialization in Pipecat LivekitFrameSerializer

SQL Injection in Jizhicms Product Editing Module

Remote Code Execution via Dynamic Code Loading

Code Injection in Froxlor Server Admin

Authentication Bypass Leading to Remote Code Execution

Path Traversal in Vite+ downloadPackageManager Cache

OS Command Injection in Paperclip Server

Code Injection / Sandbox Escape in Luanti / Minetest Mods

Path Traversal in PsiTransfer File Upload Handler

Command Injection in Rclone

Missing Authentication for Critical Function in Rclone RC

NoSQL Injection in Rocket.Chat OAuth Token Handling

SSRF in WeKan Webhook Integrations

Missing Authorization in WeKan Integration REST API

Command Injection in radare2 PDB Parser print_gvars()

SQL Injection in Jellystat API Endpoints Leading to

Improper Access Control in OpenRemote Manager–Keycloak

Code Injection in Generated Code in Kiota OpenAPI Client

Missing Authorization in RustFS Event Handlers

XML External Entity (XXE) in OpenRemote Velbus Asset Import

Path Traversal in EspoCRM Admin Interface

Path Traversal in EspoCRM Formula Engine

Quorum / Signature Verification Bypass in Nimiq Skip Block

Path Traversal in Xerte Online Toolkits elFinder Connector

Path Traversal / Incomplete Path Validation in uutils

Access Control / Function Routing Abuse in ThinkPHP 5.0.23

Authentication Bypass in MinIO PutObject Handlers

Authentication Bypass in MinIO Object Storage

Command Injection in WWBN AVideo CloneSite

OS Command Injection in WWBN AVideo test.php

SSRF in GitHub Enterprise Server Notebook Rendering

Improper Authorization / Broken Access Control

OS Command Injection in GitHub Enterprise Server Proxy

Server-Side Request Forgery (SSRF) in WWBN AVideo

Path Traversal in WWBN AVideo CloneSite deleteDump Parameter

SSRF in WWBN AVideo LiveLinks Proxy

CSRF in WWBN AVideo Admin JSON Endpoints

Path Traversal in Hermes WebUI delete Endpoint

OS Command Injection in Flowise Custom MCP Adapter

CSRF in AVideo Global Configuration Update Endpoint

Code Injection in AVideo YPTSocket WebSocket Plugin

SQL Injection in ElectricSQL shape API

Open Redirect / Host Header Poisoning in LinkAce

Information Exposure / Sensitive Data Leakage

Path Traversal File Write in WWBN AVideo locale/save.php

SQL Injection in Vendure Shop and Admin APIs via

Sensitive Information Exposure in goshs Protected Folders

Authentication Bypass in goshs SFTP Service with

CSRF in goshs State-Changing GET Endpoints

Path Traversal in goshs SFTP Jail Enforcement

SQL Injection in Mailcow Quarantine Notification Workflow

Missing Authorization in Decidim /api Endpoint

Path Traversal / Directory Traversal in FreeScout Help Desk

Missing Authorization in FreeScout Reply/Draft Flows

Path Traversal in Lego ACME Webroot HTTP-01 Provider

Improper Authorization in ClearanceKit macOS File Access

Incorrect Authorization in FreeScout

Missing Authorization in FreeScout Draft Saving Endpoint

Authorization Bypass / Access Control in FreeScout Customer

Improper Authorization / Insecure Direct Object Reference

Improper Authorization in FreeScout Customer Email

Improper Brute-Force Protection in blueprintUE

Information Disclosure in RansomLook Location API Filtering

Path Traversal in excel-mcp-server Remote Excel File Handler

Mass Assignment / Authorization Misconfiguration

Stored XSS in FreeScout Mailbox Signatures

OS Command Injection in Tenda W30E

OS Command Injection in Tenda W30E do_ping_action Interface

Improper Access Control / Information Exposure

Unrestricted File Upload in Visitor Management System Admin

OS Command Injection in Dolibarr Website Module

Code Injection / Improper Access Control in Dolibarr

OS Command Injection in FreePBX API GraphQL Mutation

XSS in FreeScout Mailbox Signature Rendering

Weak Cryptographic Token Generation in FreeScout Help Desk

Path Traversal in Apktool Resource File Decoder

Command Injection in Lawnchair GitHub Actions

Sandbox Escape via Symlink Path Traversal in Claude Code

Broken Access Control / Privilege Escalation in Neko

Authorization Bypass in OpenClaw Discord Exec Approval

SSRF in OpenClaw Marketplace Plugin Downloader

SSRF in OpenClaw Marketplace Plugin Downloader

SSRF in Glances IP Plugin public_api Configuration

Path Traversal / Authorization Logic Flaw in OpenClaude

SSRF in LMDeploy Vision-Language Image Loader

Authentication Bypass via LDAP Injection in Roxy-WI LDAP

Improper Authorization in Nginx UI Token Handling

Code Injection / Expression Language Injection

Improper Input Validation in Spinnaker Clouddriver GitRepo

Improper Privilege Management in OpenXiangShan NEMU

Unrestricted File Upload in Vvveb CMS Media Manager

Unrestricted File Upload in Vvveb CMS Media Handler Leads

OS Command Injection in Flowsint org_to_asn Transformer

SQL Injection in Forgot Password Email Parameter of

SQL Injection in Apartment Visitors Management System

SQL Injection in Apartment Visitors Management System Login

Unrestricted File Upload in OpenMage LTS Product Custom

Improper Access Control / Authorization in Doorman User API

Unsafe Deserialization in OpenMage LTS Media Handling

Code Injection in Vvveb Installation Endpoint

SSRF in Vvveb oEmbedProxy Endpoint

Missing Authentication and Authorization in Vexa

Code Injection via Template Engine in SGLang rerank Jinja2

Improper Authentication in Rowboat Labs Rowboat

SSRF in Mogu Blog Picture Storage Service

Prototype Pollution in 1024bit extend-deep

Path Traversal in SuperAGI Multipart Upload Handler

OS Command Injection in ADM PPTP VPN Client Web Interface

SSRF in Agentscope _process_audio_block URL Handling

SSRF in ModelScope AgentScope Internal Service

SSRF in Agentscope Cloud Metadata Endpoint

Code Injection in AgentScope

Unrestricted File Upload in Hospital Management System

Unrestricted File Upload in Langflow API Endpoint

Prototype Pollution / Code Injection in brikcss merge

Missing Authentication / Broken Access Control

Missing Authentication in DjangoBlog logtracks Endpoint

SQL Injection in dameng100 muucmf Search Module

Code Injection in protobufjs Decoding

Authorization Bypass / Incorrect Authorization

Command Injection in Airflow BashOperator Usage

Unsafe Deserialization in Apache Airflow Webserver

Cross-Site Scripting (XSS) in Postiz

OS Command Injection in Emissary Executrix.getCommand()

Improper Privilege Management in NovumOS MemoryMapRange

Access Control / Authorization in Movary User Management

Improper Input Validation / Privilege Management in NovumOS

Path Traversal / Insecure File Write in Gzip Extraction

CSRF in ChurchCRM Family Deletion Endpoint

Unrestricted File Upload / Arbitrary File Write

Missing Authorization in Movary User Settings API

SSRF in Movary Jellyfin Server URL Verification

Access Control / Authorization Bypass in wger Gym

Path Traversal / Zip Slip in Gramps Web Media Archive Import

Command Injection in radare2 DWARF Parameter Name Handling

Cross-Site Scripting (Stored XSS) in WeGIA Member

SQL Injection in WeGIA UsuarioDAO

OS Command Injection in Dolibarr ODT to PDF Conversion

Missing Authentication in Anviz CX2 Lite and CX7

Path Traversal and Insecure Library Loading in Firebird

OS Command Injection in Anviz CX2 Lite Filename Parameter

Missing Authentication in Anviz CX2 Lite and CX7

Buffer Overflow in Firebird Database Server

Information Exposure in Firebird FB3 Client Library

Path Traversal in ByteDance DeerFlow Bootstrap Custom-Agent

SSRF in OpenHarness web_fetch and web_search Tools

Authorization Bypass in OpenHarness File Tools

SQL Injection in CodeAstro Simple Attendance Management

SQL Injection in QueryMine SMS admin/deletecourse.php

SSRF in CraftQL Asset Schema Handling

OS Command Injection in Wavlink WL-WN530H4 internet.cgi

Stored Cross-Site Scripting (XSS) via File Upload

Cross-Site Scripting (XSS) in SiYuan Desktop

Improper Authorization in SiYuan Attribute View Deletion API

OS Command Injection in sagredo qmail notlshosts_auto

Improper Authorization / Access Control in free5GC UDR

Improper Access Control in free5GC UDR Traffic Influence

Improper Authorization in free5GC UDR Traffic Influence

Unsafe Deserialization in DataEase Quartz Job Handling

SQL Injection in DataEase previewSql Endpoint

SQL Injection in DataEase getTableField Endpoint

SQL Injection in DataEase Datasource Update API

SQL Injection in DataEase Datasource Saving API

SQL Injection in DataEase enumValueObj Endpoint

Path Traversal (CWE-22) in OCaml opam .install handling

SQL Injection in DataEase Dataset Endpoints

SQL Injection in DataEase Dataset Export Expression Filters

Cryptographic Key Management and Unsafe Deserialization

SQL Injection in SourceCodester Payroll Management and

SQL Injection in Vehicle Parking Area Management System

SQL Injection in SourceCodester Vehicle Parking Area

SQL Injection in SourceCodester Vehicle Parking Area

SQL Injection in SourceCodester Vehicle Parking Area

SQL Injection in Vehicle Parking Area Management System

SQL Injection in SourceCodester Simple Music Cloud

SQL Injection in SourceCodester Simple Music Cloud

SQL Injection in SourceCodester Simple Music Cloud

SQL Injection in SourceCodester Simple Music Cloud

SQL Injection in SourceCodester Simple Music Cloud

Broken / Missing Access Control in goodoneuz/pay-uz Laravel

OS Command Injection in radare2 rabin2 -PP PDB Name Handling

Missing Authorization in OpenHarness Gateway

Information Disclosure in free5GC UDR InfluenceData API

LDAP Injection in maddy auth.ldap Authentication Module

Code Injection / Insecure CI Workflow in OWASP BLT GitHub

Command Injection in Composer Perforce Integration

Command Injection in Composer VCS Support

Information Disclosure in Dgraph Alpha

Cross-Site Scripting (Stored XSS) in ApostropheCMS SEO

Improper Privilege Management in Weblate User Patching API

Path Traversal / Symlink Attack in Weblate ZIP Download

Missing Brute-Force Protection in OpenProject 2FA

Arbitrary File Upload / Unsafe File Handling in Weblate

Information Exposure in Git for Windows

OS Command Injection in Upsonic

Command Injection in FuelCMS Installer add_git_submodule

Command Injection in NietThijmen ShoppingCart connect

Header Manipulation (CWE-644) in Fastify Proxy Modules

Risky Crypto and Weak Signature Checks in Bouncy Castle

Weak GCM-like Cipher (CWE-327) in Bouncy Castle BC-JAVA

Command Injection in radare2 PDB Parser print_gvars()

Path Traversal in Zarf SBOM & Documentation Inspect Output

HTTP Response / Header Injection in Serendipity Email

Expression Language Injection in OpenRemote Rules Engine

Unrestricted File Upload in WebStack WordPress Theme

Code Injection in Airflow XCom Documentation Example

Improper Input Validation and Path Traversal in NuGet

Command/Argument Injection in Jellyfin Streaming ffmpeg

Server-Side Request Forgery and Insecure Resource Access

Path Traversal File Write in Jellyfin Subtitle Upload

Command Injection in Podman HyperV Machine Backend

Broken Access Control / Authorization Bypass in Chamilo LMS

External Control of File Path in Unisys WebPerfect Image

OS Command Injection in Chamilo LMS Gradebook Certificate

Insecure Direct Object Reference (IDOR) in Chamilo LMS

SSRF in Chamilo LMS PENS Plugin Endpoint

SSRF in Chamilo LMS install.ajax.php

SQL Injection in Chamilo LMS Statistics AJAX Endpoint

OS Command Injection in openITCOCKPIT Monitoring Backend

OS Command Injection in Fortinet FortiSandbox

Broken Access Control / Object-Level Authorization

Broken Object-Level Authorization (BOLA) in Webkul Krayin

Broken Access Control / BOLA in Webkul Krayin CRM User

SQL Injection in Krayin CRM Lead Data Grid (rotten_lead

SSRF in Webkul Krayin CRM Webhook Creation

Unrestricted File Upload in Webkul Krayin CRM TinyMCE Admin

SQL Injection in School Management System Report Filter

SQL Injection in School Management System 1.0

SQL Injection in Grocery Store Management System

HTTP Request Smuggling in Eclipse Jetty HTTP/1.1 Parser

SQL Injection in PraisonAI SQLiteConversationStore Table

Missing Authentication / Broken Session Enforcement

Command Injection and Arbitrary Code Execution

Arbitrary Code Execution via Insecure Dynamic Loading

Command Injection (CWE-77) via webbrowser.open URLs

Unbounded Recursive XML Free (CWE-674) in ImageMagick

Arbitrary File Upload / Code Injection in Phpgurukul Online

Code Injection via Insecure Deserialization in Pyro v3.x

Command Injection in KubePlus kubeconfiggenerator

OS Command Injection in Totolink A7100RU CGI Password

OS Command Injection in simple-git

SQL Injection in PHPGurukul Daily Expense Tracking System

SQL Injection in /ajax.php?action=login of Pharmacy Sales

SQL Injection in Sourcecodester Online Thesis Archiving

Cross-Site Scripting (XSS) in Decidim User Name Field

SQL Injection in delete_sales Endpoint of Pharmacy Sales

SQL Injection in chk_prod_availability Endpoint of Pharmacy

SQL Injection in code-projects Simple Content Management

SQL Injection in Simple Content Management System login.php

Unsafe Deserialization in Apache Airflow Webserver

Incorrect Access Control in Totara LMS

Cross-Site Scripting (XSS) in Totara LMS Messaging

Unsafe Deserialization in Keras TFSMLayer Safe Mode Handling

Command Injection in LibreNMS

SQL Injection in Faculty Management System

SQL Injection in Vehicle Showroom Management System

SQL Injection in Vehicle Showroom Management System

SQL Injection in Lost and Found Thing Management

SQL Injection in Lost and Found Thing Management

SQL Injection in Simple ChatBox Endpoint

OS Command Injection in Totolink N300RH Firmware Upgrade

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU CGI setWanCfg

OS Command Injection in Totolink A7100RU CGI setWizardCfg

SQL Injection in Vehicle Showroom Management System

SQL Injection in Vehicle Showroom Management System

SQL Injection in Vehicle Showroom Management System Payment

SQL Injection in Vehicle Showroom Management System

SQL Injection in Vehicle Showroom Management System

SQL Injection in Hotel Management System roomdelete.php

OS Command Injection in Totolink A7100RU CGI Firmware

OS Command Injection in Totolink A7100RU CGI

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU CGI setLedCfg

OS Command Injection in Totolink A7100RU CGI

OS Command Injection in ChatboxAI Model Context Protocol

Missing Authentication in CowAgent Agent Mode Service for

SQL Injection in Newsbull Haber Script Search Parameter

SQL Injection in CMSsite 1.0

Missing Authentication in CowAgent 2.0.4

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU CGI Network

Command Injection (CWE-77) in Totolink A7100RU API

OS Command Injection in Totolink A7100RU CGI Handler

Code Injection in MetaGPT Tree-of-Thought Solver

XSS in parisneo/lollms AppLollmsMessage.from_dict

Path Traversal / Directory Traversal in Gleam Compiler

Privilege Escalation in BuddyPress Groupblog

Broken Access Control / IDOR in FastGPT Multi-Tenant

Server-Side Request Forgery (SSRF) in Arcane fetch Endpoint

Missing Authorization in goshs HTTP Server

Missing Authorization in TREK Immich Trip Photo Management

Path Traversal in Quarkus OpenAPI Generator unzip()

Authentication Bypass in Ajenti Core Plugin

Server-Side Request Forgery and HTTP Header Manipulation

Server-Side Request Forgery (SSRF) in Postiz stream Endpoint

Improper Authorization in Chartbrew Template Generation

SSRF in Chartbrew API Data Connections

Insufficient Randomness in Chamilo LMS

Improper Privilege Management in Chamilo LMS User Status

Unrestricted File Upload in Chamilo LMS

Insecure Direct Object Reference (IDOR) in Chamilo LMS

Code Injection in Chamilo LMS Platform Configuration Parsing

Path Traversal / Insecure File System Access in Saltcorn

Improper Input Validation in Bugsink Artifact Bundle

Unrestricted File Upload in Chamilo LMS Exercise Sound

Insecure Direct Object Reference (IDOR) in Chamilo LMS

Insecure Direct Object Reference (IDOR) in Chamilo LMS

OS Command Injection in Chamilo LMS File Move Function

SSRF in Chamilo LMS Social Wall Open Graph Fetcher

Session Management Vulnerability in Chamilo LMS AICC HACP

Path Traversal / Arbitrary File Access in Chamilo LMS

Code Injection / Sandbox Escape in PraisonAI Python Agent

Path Traversal / Directory Traversal in PraisonAI Recipe CLI

Arbitrary Code Execution via Insecure Auto-Loading

Path Traversal in OpenClaw Sandbox Media URL Handling

Missing Authorization in OpenClaw Gateway /reset Session

Incorrect Authorization in OpenClaw /reset-profile Endpoint

Improper Privilege Management in Vikunja Project

Improper Authentication in Vikunja OIDC Callback Skipping

Output Encoding and Data Representation in Apache Log4j

Improper Output Encoding in Apache Log4j XmlLayout

Improper Output Encoding / Escaping in XML Layout for

Log Injection and Improper Output Handling in Apache Log4j

Insecure Direct Object Reference / Broken Authorization

SQL Injection in SourceCodester Engineers Online Portal

SQL Injection in Online Student Enrollment System

SQL Injection in itsourcecode Online Student Enrollment

SQL Injection in assignInstructorSubjects.php of Online

SQL Injection in Online Student Enrollment System

SQL Injection in PHP-MYSQL-User-Login-System login.php

Improper Authorization in Juju Controller CloudSpec API

Path Traversal in FalkorDB Browser File Upload API

SQL Injection in Vehicle Showroom Management System

SQL Injection in Vehicle Showroom Management System

SQL Injection in Vehicle Showroom Management System

SQL Injection in Simple IT Discussion Forum

OS Command Injection in Totolink A7100RU CGI VPN

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU CGI

OS Command Injection in Totolink A7100RU

Cross-Site Scripting (XSS) in Lollms Social Home Feed

OS Command Injection in Totolink A7100RU setSyslogCfg CGI

Path Traversal in Tenda i6 HTTP Security Handler

Improper Certificate Validation in wolfSSL OpenSSL

SQL Injection in Simple IT Discussion Forum

OS Command Injection in Totolink A7100RU CGI Login Password

OS Command Injection in Totolink A7100RU CGI Handler

Command Injection (CWE-78) in Totolink A7100RU Router

OS Command Injection in Totolink A7100RU Telnet

OS Command Injection in Totolink A7100RU CGI Handler

SQL Injection in user_Id Parameter of Simple IT Discussion

SSRF in PraisonAIAgents web_crawl Tool

SSRF in PraisonAI runs Webhook Handling

OS Command Injection in PraisonAIAgents Memory Hooks

Improper Privilege Management in OpenClaw Gateway Plugin

SSRF in OpenClaw Channel Extensions

Improper Access Control in OpenClaw Session Termination

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU CGI WiFi

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU CGI DMZ

OS Command Injection in MetaGPT Bash.run Tooling

OS Command Injection in MetaGPT get_mime_type Utility

OS Command Injection in MetaGPT Terminal.run_command

Improper Certificate Validation in ECDSA/ECC Signature

Missing Authentication / Authorization in Modbus-Controlled

SSRF in Sonicverse Radio Dashboard API Client

OS Command Injection in PraisonAI Multi-Agent Workflows

Command Injection in ToToLink A3300R stun-pass Parameter

Code Injection / Dynamic Code Evaluation in MetaGPT XML

Code Injection in MetaGPT HumanEval/MBPP Benchmarks

Server-Side Request Forgery (CWE-918) via CCIP Read in web3.py Ethereum Clients

Missing Authentication in marimo Reactive Python Notebook

Path Traversal in AGiXT essential_abilities Workspace

Path Traversal in Tenda CH22 httpd

SQL Injection in Simple IT Discussion Forum

Authentication Bypass in Laravel Passport OAuth2 Guard

SSRF in n8n-MCP Multi-Tenant HTTP Interface

LDAP Injection in MISP Apache Authentication Integration

Improper Access Control in Directus File PATCH Endpoint

Code Injection / DLL Injection in OSGeo MapServer

Server-Side Request Forgery (SSRF) in Plane Favicon Fetcher

Path Traversal in Helm Plugin Installation Leading to

Code Injection in Kiamo Administrative Interface

LDAP Injection in OPNsense LDAP Authentication Connector

CSRF in phpBB3 Authentication Workflow

Improper Access Control / Proxy Bypass in Axios HTTP Client

SSRF in Jizhicms User Evaluation, Message, and Comment

Improper Input Validation in Canonical LXD Backup Import

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU setIpv6LanCfg CGI

OS Command Injection in Totolink A7100RU CGI Handler

OS Command Injection in Totolink A7100RU setUPnPCfg CGI

OS Command Injection in Totolink A7100RU CGI Handler

Directory Traversal / Path Traversal in Tenda i12 HTTP

Authorization Bypass in decolua 9router Administrative API

Path Traversal in Tenda i3 HTTP R7WebsSecurityHandler

SQL Injection in PHPGurukul News Portal /news-details.php

SSRF in api-lab-mcp HTTP Interface

SQL Injection in content.php of Simple IT Discussion Forum

SQL Injection in Simple IT Discussion Forum addcomment.php

SQL Injection in Simple IT Discussion Forum

SQL Injection in Simple Laundry System /userchecklogin.php

SQL Injection in PHPGurukul Online Course Registration 3.1

SQL Injection in PHPGurukul Online Course Registration

OS Command Injection in UAC Placeholder Substitution

OS Command Injection in parseusbs Volume Listing Path

OS Command Injection in parseusbs LNK Filename Handling

Path Traversal in ALEAPP NQ_Vault Artifact Output Handling

Path Traversal in Sleuth Kit tsk_recover File Recovery

SQL Injection in Easy Blog Site contact_us.php Name

Path Traversal / Arbitrary File System Access

Template Injection / Code Injection in PraisonAI

Unsafe Deserialization in PraisonAI

Information Exposure / Broken Access Control in PraisonAI

SSRF in FrontMCP mcp-from-openapi Dereferencing

Missing Authentication and Authorization in kcp Cache Server

OS Command Injection in mcp-javadc HTTP Interface

OS Command Injection in Tophat macOS Test Harness

Path Traversal in LiquidJS Template File Loading

SSRF in InvenTree Remote Image Download

Improper Authorization in InvenTree API

Improper Authorization / Access Control in InvenTree

Denial of Service / Uncontrolled Resource Consumption

Stored XSS in Immich 360° Panorama OCR Viewer

Cross-Site Scripting and Insecure Direct Object Access

Server-Side Template Injection in Zammad AI Agent Type

Improper Access Control in Zammad Getting Started Endpoint

SQL Injection in LORIS MRI Feedback Imaging Browser

Command Injection in Fleet Orbit FileVault Key Rotation

SSRF in ERPNext/Frappe PDF Print Format Rendering

SSRF in QD 20230821 Request Handling

Missing Authorization / Access Control in XWiki Platform

Code Injection in stata-mcp

Path Traversal in Hono toSSG()

Missing Authentication / Access Control on Critical

Stale Authentication State / Race Conditions in Security

Path Traversal in Emmett RSGI Static Handler for Internal

Stored XSS in SiYuan Electron Desktop Client

Improper Certificate Validation in Botan

Path Traversal in Flatpak ld.so Cache Handling

Missing Authorization in Payload Puck CRUD API Endpoints

Improper Access Control in mise Project Configuration

Resource Exhaustion and Information Exposure in Podman

Unsafe Deserialization in OpenAM jato.clientSession

OS Command Injection in docker-mcp-server HTTP Interface

Code Injection in PowerJob OpenAPI /addWorkflowNode

CSRF in RedwoodSDK Server Functions

SSRF in WWBN AVideo Upload-by-URL Flow

Path Traversal / Arbitrary File Read in WWBN AVideo GIF

Improper Access Control in Vite Dev Server Static File

Information Disclosure in Vite Dev Server Module Fetching

SSRF in OpenObserve Enrichment URL Validation

SQL Injection in Drizzle ORM

Improper Authentication in PolarLearn Sign-In Endpoint

Improper Access Control in GenieACS NBI API Endpoint

SQL Injection in PowerJob detailPlus Endpoint

Broken Access Control in Genealogy Team Ownership Transfer

Missing Authorization in Frappe Doctype API Access

DNS Cache Poisoning / Improper Remote Code Specification

XSS in ChurchCRM Login Username Parameter

SQL Injection in ChurchCRM EditEventTypes Administrative

SQL Injection in ChurchCRM Advanced Search Query

SQL Injection in ChurchCRM Confirm Report Email Endpoint

SQL Injection in ChurchCRM Property Type Administration

Authorization / Access Control in ChurchCRM API Middleware

Code Injection in ChurchCRM Setup Wizard Database Password

SQL Injection in ChurchCRM SettingsIndividual Endpoint

XSS in ChurchCRM FindFundRaiser Endpoint

Cross-Site Scripting (XSS) in ChurchCRM GeoPage

Broken Access Control / Insecure Direct Object Reference

SQL Injection in ChurchCRM /PropertyAssign.php Endpoint

SQL Injection in ChurchCRM Event Type Creation

Stored XSS in ChurchCRM Person Profile Social Fields

SQL Injection in ChurchCRM Member Role Change Endpoint

SQL Injection in ChurchCRM PropertyTypeEditor Endpoint

SQL Injection in ChurchCRM /SettingsUser.php Endpoint

Improper Authentication / Session Validation in Rack::Sessio

SQL Injection in ChurchCRM PropertyTypeEditor.php

SQL Injection in ChurchCRM FundRaiser Editor Endpoint

SQL Injection in ChurchCRM GroupPropsFormRowOps

SQL Injection in ChurchCRM SettingsIndividual.php

Stored XSS in ChurchCRM Person Property Management

Cross-Site Scripting (XSS) in ChurchCRM Admin Group Creation

Path Traversal and Unrestricted File Upload in ChurchCRM

Broken Access Control in MRCMS User Management Controller

Improper Access Control in OpenHarness Agent File Tools

OS Command Injection (CWE-78) in Cockpit Remote Login

Broken Access Control / Insecure Direct Object Reference

Path Traversal in PraisonAI Recipe Registry Publish Endpoint

Path Traversal / Zip Slip in PraisonAI Template Installation

Path Traversal File Write in PraisonAI Recipe Registry Pull

Path Traversal in PraisonAI Action Orchestrator Workspace

Path Traversal in PraisonAI _validate_path() File Handling

SQL Injection in Frappe bulk_update API

Improper Authorization in PolarLearn Account Management

Improper Privilege Management in File Browser Proxy

Missing Authorization in File Browser Text Content Handler

Path Traversal in File Browser Access Rules

Broken / Missing Authorization in File Browser

OS Command Injection in File Browser

OS Command Injection in Emissary Executrix Shell Command

OS Command Injection in Emissary GitHub Actions Workflows

Stored Cross-Site Scripting (XSS) in ChurchCRM Note Editor

Authentication Bypass in Strawberry GraphQL graphql-ws

SQL Injection in Windmill Folder Ownership Management

Missing Authorization in Windmill Workspace API

SQL Injection in Koha OPAC Send Basket Functionality

SQL Injection in ChurchCRM Member Role Change Handler

XSS in ChurchCRM PersonView Facebook Field

Command Injection in Pi-hole FTL DHCP Hosts Parameter

Command Injection in Pi-hole FTL (FTLDNS)

Command Injection in Pi-hole FTL dns.hostRecord

Command Injection in Pi-hole FTL Engine

Command Injection in Pi-hole FTL (FTLDNS)

Missing Authorization in changedetection.io Flask Routes

Improper Access Control and Input Validation in Tandoor

SSRF in text-generation-webui RAG Extensions

Code Injection in FuelCMS Blocks Module

Command Injection in Koha Library Cover Image Processing

Path Traversal in text-generation-webui load_grammar File

Unsafe Deserialization in pyLoad Download Directory

OS Command Injection in pyLoad AntiVirus Plugin

Improper Certificate Validation in Erlang OTP OCSP

Incorrect Authorization in Erlang OTP inets HTTP Server

Eval Injection in Dolibarr dol_eval_standard() Computed

HTTP Request Smuggling / Desynchronization in Tinyproxy

Improper Access Control in parisneo/lollms Session

Unsafe Deserialization in HuggingFace Transformers Trainer

OS Command Injection in Totolink A7100RU setGameSpeedCfg

OS Command Injection in Totolink A7100RU setFirewallType

OS Command Injection in Totolink A7100RU setRemoteCfg

OS Command Injection in Totolink A7100RU setNtpCfg CGI

OS Command Injection in Totolink A7100RU setDdnsCfg CGI

OS Command Injection in AWS Research and Engineering Studio

OS Command Injection in AWS Research and Engineering Studio

Path Traversal in goshs SimpleHTTPServer

Information Disclosure in Directus API

Broken Access Control in Directus TUS Resumable Upload

SSRF in Directus Request Handling

SQL Injection in WeGIA DespachoDAO Memorando Handling

Path Traversal in goshs Multipart File Upload Handling

Path Traversal in goshs SimpleHTTPServer

Improper Certificate Validation in Bulwark Webmail S/MIME

Server-Side Request Forgery (SSRF) in pyLoad Downloader

Server-Side Request Forgery (SSRF) in pyLoad parse_urls API

Improper Access Control in HAX CMS

SQL Injection in EcclesiaCRM Query View Template

Insecure Direct Object Reference (IDOR) in Brave CMS

Missing Authorization in Brave CMS Role Update Endpoint

Code Injection in Salesforce Workbench Timezone Conversion

Improper Access Control in Distribution Blob Deletion and

OS Command Injection in Totolink A7100RU setScheduleCfg

OS Command Injection in Totolink A7100RU CsteSystem Handler

Missing Authentication / Broken Access Control

SQL Injection in Simple IT Discussion Forum

SQL Injection in OpenSTAManager confronta_righe.php Modules

Path Traversal and Arbitrary File Write in Chyrp Lite

Code Injection / Unsafe Dynamic Execution in Kedro

Path Traversal in Kedro Data Catalog

Unrestricted File Upload in Brave CMS CKEditor Upload

Remote Code Execution via Web Application State

Path Traversal File Write in text-generation-webui

Unrestricted File Upload in Brave CMS CKEditor Endpoint

Insecure Direct Object Reference (IDOR) in Tandoor Recipes

OS Command Injection in BentoML Cloud Deployment Path

SQL Injection in Password Parameter of Cyber-III

Server-Side Request Forgery (SSRF) in Ech0 Website Title API

SSRF in Ech0 Link Preview Endpoint

XSS in CI4MS System Settings – Company Information

Improper Authentication in LiteLLM JWT/OIDC Gateway

Missing Authorization in LiteLLM AI Gateway

Cross-Site Scripting (XSS) in CI4MS Profile Name Handling

Command Injection in Aperi'Solve JPEG Password Handling

Missing Authorization in Dgraph GraphQL Database

Path Traversal in Ferret Web Data Engine

SQL Injection in Login Authentication of Online FIR System

OS Command Injection in Vim

Sensitive Information Exposure via URL in Nhost Auth OAuth

Broken or Risky Cryptographic Algorithm Usage

OS Command Injection in KubeAI Ollama Startup Probe Script

Improper Access Control / Sandbox Escape in Lupa Lua/LuaJIT

SQL Injection in ChurchCRM PropertyAssign Endpoint

SSRF in curl_cffi Python Binding

OS Command Injection in DCMTK storescp Service

Server-Side Request Forgery (SSRF) / Insecure

Cross-Site Scripting (DOM-based) in Homarr Login Callback

Command Injection in UTT Aggressive HiPER 520W formDia

SQL Injection in GLPI Logs Export Feature

SQL Injection in GLPI Search Engine

Cross-Site Scripting (XSS) in GLPI Inventory Endpoint

Template Injection / Code Injection in GLPI Administration

Cross-Site Scripting (XSS) in GLPI Supplier Fields

SQL Injection in Simple Laundry System 1.0

SQL Injection in Easy Blog Site 1.0 login.php Authentication

SQL Injection in Projectworlds Car Rental System pay.php

Improper Authorization in Cyber-III

SQL Injection in Message Parameter Handling of Car Rental

SQL Injection in Projectworlds Car Rental /book_car.php

SSRF in gpt-researcher WebSocket Endpoint

Missing Authentication in gpt-researcher HTTP REST API

Command Injection in gpt-researcher WebSocket Endpoint

Missing Authentication / Authorization in JeecgBoot AI Chat

SQL Injection in CMSsite post.php 'post' Parameter

Arbitrary File Upload in UniSharp Laravel File Manager

Code Injection in Fosowl agenticSeek Query Endpoint

SQL Injection in Song-Li cross_browser details Endpoint

SQL Injection in Login Component of jkev Record Management

Unrestricted File Upload in Technostrobe HI-LED-WR120-G2

Improper Authentication in Technostrobe HI-LED-WR120-G2

Improper Access Control in Technostrobe HI-LED-WR120-G2

SQL Injection in Parameter Handler of Simple Laundry System

SQL Injection in Simple Laundry System /searchguest.php

SQL Injection in Concert Ticket Reservation System login.php

SQL Injection in Concert Ticket Reservation System

SQL Injection in Free Hotel Reservation System Admin Login

SQL Injection in Simple Laundry System Parameter Handler

Unsafe Deserialization in FedML gRPC Server sendMessage

SQL Injection in Online Enrollment System Parameter Handler

OS Command Injection in PraisonAI SubprocessSandbox

SSRF in PraisonAI FileTools.download_file()

Missing Authorization / Authentication Bypass

Missing Authentication in PraisonAI Multi-Agent System

OS Command Injection in PraisonAI run_python Shell Wrapper

SSRF in PraisonAI passthrough APIs

OS Command Injection in PraisonAI Multi‑Agent System

SQL Injection in PraisonAI get_all_user_threads Query

SQL Injection in Kestra Flow Search API

Path Traversal in Emlog emUnZip() File Handling

Authentication Bypass in OpenPrinting CUPS Admin Interface

Improper Input Validation in OpenPrinting CUPS PostScript

Authentication Bypass in OAuthenticator for JupyterHub

Server-Side Template Injection in RAGFlow Agent Workflow

SQL Injection in Piwigo Activity List API Endpoint

SQL Injection in Piwigo pwg.users.getList Web Service API

Missing Authorization in Piwigo pwg.history.search API

SQL Injection in Piwigo Date Filter Parameters

Missing Authentication in Administrative Management Endpoint

Missing Authentication / Broken Access Control

Insecure Direct Object Reference (IDOR) in Authenticated

SSRF in prompts.chat Fal.ai Media Status Polling

Missing Authorization in prompts.chat Private Prompt APIs

Path Traversal / Directory Traversal in prompts.chat

Hardcoded Credentials in Mobile App and Device Firmware

Server-Side Request Forgery (SSRF) in ZimaOS Proxy Endpoint

Stored XSS in Budibase Builder Command Palette

Command Injection in Budibase Server

Path Traversal File Write in Budibase Plugin File Upload

SSRF in Budibase REST Datasource Connector

OS Command Injection in Budibase Bash Automation Step

SQL Injection in Focalboard Category Reordering API

Command Injection in pymetasploit3

Insufficiently Protected Credentials in Temporary Browser

Missing Authentication in OneUptime Worker Service

XSS in Hoppscotch API Development Ecosystem

Open Redirect in Hoppscotch Leading to Token Exfiltration

Unsafe Deserialization in Group-Office

Improper Authentication in Bulwark Webmail Settings API

SSRF in Appsmith Dashboard WebClientUtils

Missing Authorization in OneUptime Twilio Integration

Missing Authentication in OneUptime

Path Traversal File Write in Fireshare Public Chunked

SQL Injection in projectworlds Car Rental Project Parameter

Stored XSS in DbGate Web and Electron UI

SQL Injection in OpenProject Reporting =n Operator

XML Injection in xmldom DOMParser/XMLSerializer

SSRF in Postiz Public Stream Proxy Endpoint

SSRF in Postiz URL Upload Endpoint

Path Traversal in SillyTavern Chat Avatar Handling

Path Traversal / File System Access Control in SillyTavern

Improper Input Validation / Path Matching in Rack::Static

Authentication and Authorization Misconfiguration

Broken Access Control / Authentication Bypass

Broken Authentication / Improper Signature Verification

SSRF in hm_editor image-to-base64 Endpoint

Eval Injection / Code Injection in Agno Model Execution

Path Traversal in phpMyFAQ Media Browser

Command Injection in Glances Monitoring Tool

SSRF in FastMCP OpenAPIProvider URL Construction

SQL Injection in Online Enrollment System 1.0

Command Injection in DefaultFuction CMS tools.php

SQL Injection in OpenSTAManager Aggiornamenti Module

Access Control Bypass in Customer-Managed ShareFile Storage

Unsafe Deserialization in OpenSTAManager OAuth2 Endpoint

SQL Injection in OpenSTAManager AJAX Select Handlers

SSRF in WordPress Webmention Plugin Author Parsing

SQL Injection in MCP Handler Database Server Request

Missing Authentication in Vanna Chat API Endpoint v2

Improper Access Control in CI4MS CMS Skeleton

Cross-Site Scripting (XSS) in CI4MS Backend User Management

Broken Access Control / Session Management in CI4MS CMS

Cross-Site Scripting (XSS) in CI4MS Blog Category Management

XSS in CI4MS Blog Post Content Handling

XSS in CI4MS Blog Categories Management

Cross-Site Scripting (XSS) in CI4MS Page Management

Cross-Site Scripting (XSS) in CI4MS Menu Management

Cross-Site Scripting (XSS) in CI4MS Menu Management

Cross-Site Scripting (XSS) in CI4MS Backup Management Views

Cross-Site Scripting (XSS) in CI4MS Logs Interface

Cross-Site Scripting (XSS) in CI4MS Blog Tag Management