CVE Find : surveillez les vulnérabilités en temps réel

CVE-2025-10553 - HIGH
31/03/2026

A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-10551 - HIGH
31/03/2026

A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-34042 - HIGH
31/03/2026

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can ...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-34040 - HIGH
31/03/2026

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-32714 - CRITICAL
31/03/2026

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in ve...

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-3300 - CRITICAL
31/03/2026

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not ...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-30877 - CRITICAL
31/03/2026

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-21861 - CRITICAL
31/03/2026

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in vers...

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-32957 - HIGH
31/03/2026

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is includ...

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-5156 - HIGH
31/03/2026

A vulnerability was determined in Tenda CH22 1.0.0.1. This impacts the function formQuickIndex of the file /goform/QuickIndex of the component Parameter Handler. This manipulation of the argument mit_linktype causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

overflow

Plus d'informations avec CVE Find

CVE-2026-5154 - HIGH
30/03/2026

A vulnerability has been found in Tenda CH22 1.0.0.1/1.If. The impacted element is the function fromSetCfm of the file /goform/setcfm of the component Parameter Handler. The manipulation of the argument funcname leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

overflow

Plus d'informations avec CVE Find

CVE-2026-5130 - HIGH
30/03/2026

The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID without any cryptographic validation or authorization checks. The cookie value was used to override the determine_current_user filter, which al...

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-5155 - HIGH
30/03/2026

A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component Parameter Handler. The manipulation of the argument wanmode results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

overflow

Plus d'informations avec CVE Find

CVE-2026-4257 - CRITICAL
30/03/2026

The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-34558 - CRITICAL
30/03/2026

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Methods Management functionality when creating or managing application methods/pages. Multiple input fields accept attacker-controlled JavaScript payloads ...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-34557 - CRITICAL
30/03/2026

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within group and role management functionality. Multiple input fields (three distinct group-related fields) can be injected with malicious JavaScript payloads, which ...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32877 - HIGH
30/03/2026

Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C3) failed to check that the encoded value was of the expected length prior to comparison. An invalid ciphertext can cause a heap over-read of up to 31 bytes, resulting in a crash or potentially other undefined behavior. This issue has been p...

overflow

Plus d'informations avec CVE Find

CVE-2026-31946 - CRITICAL
30/03/2026

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in b...

authorisationproblemOWSAP: A07OWSAP: A02

Plus d'informations avec CVE Find

CVE-2026-28228 - HIGH
30/03/2026

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. Prior to versions 19.1.31, 20.1.18, and 20.2.5, an authenticated user with the Author role can inject Velocity directives into a reminder email template. When the reminder is processed (either triggered manually or via the daily cron job), the injected directives are evaluated server-side...

Plus d'informations avec CVE Find

CVE-2026-5152 - HIGH
30/03/2026

A vulnerability was detected in Tenda CH22 1.0.0.1. Impacted is the function formCreateFileName of the file /goform/createFileName. Performing a manipulation of the argument fileNameMit results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

overflow

Plus d'informations avec CVE Find