Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-28289 - CRITICAL
03/03/2026

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerab...

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-26279 - CRITICAL
03/03/2026

Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job,...

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26266 - CRITICAL
03/03/2026

AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-27012 - CRITICAL
03/03/2026

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user's group (idgruppo) by directly calling modules/utenti/actions.php. This can promote an existing account (e.g. agent) into the Amministratori group as well ...

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-25146 - CRITICAL
03/03/2026

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0...

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-24898 - CRITICAL
03/03/2026

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HI...

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-3485 - CRITICAL
03/03/2026

A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

commandinjectionoscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-24502 - HIGH
03/03/2026

Dell Command | Intel vPro Out of Band, versions prior to 4.7.0, contain an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Plus d'informations avec CVE Find

CVE-2024-55024 - HIGH
03/03/2026

An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to perform Administrative actions using service accounts.

Plus d'informations avec CVE Find

CVE-2024-55020 - CRITICAL
03/03/2026

A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges.

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-22891 - CRITICAL
03/03/2026

A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted Intan CLP file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Plus d'informations avec CVE Find

CVE-2025-59059 - CRITICAL
03/03/2026

Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-22886 - CRITICAL
03/03/2026

OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement. In real-world deployment...

Plus d'informations avec CVE Find

CVE-2025-12345 - HIGH
03/03/2026

A security vulnerability has been detected in LLM-Claw 0.1.0/0.1.1/0.1.1a/0.1.1a-p1. The affected element is the function agent_deploy_init of the file /agents/deploy/initiate.c of the component Agent Deployment. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. A patch should be applied to remediate this issue.

overflow

Plus d'informations avec CVE Find

CVE-2026-1492 - CRITICAL
03/03/2026

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. T...

priviliegemanagementOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-2628 - CRITICAL
03/03/2026

The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators.

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-2448 - HIGH
03/03/2026

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass ...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-1566 - HIGH
03/03/2026

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level...

priviliegemanagementOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-26713 - CRITICAL
02/03/2026

code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26712 - CRITICAL
02/03/2026

code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find