Tagged “exploit-available”
CVEs tagged exploit-available, newest first.
9071 CVEsRSS
CVE-2026-104960Medium· 6.5PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access…
CVE-2026-104956Medium· 5.3PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters and passes them without an allowlist to grouped paginators, where they are use…
CVE-2026-104955Medium· 5.4PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ …
CVE-2026-104894Medium· 4.3PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any works…
CVE-2026-88397Medium· 6.5PoCApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
CVE-2026-88395Critical· 9.8PoCGouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
CVE-2026-88393Critical· 9.8PoCWookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which execut…
CVE-2026-105329Medium· 6.3PoCA vulnerability was determined in TallCMS up to 4.8.0
A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code inject…
CVE-2026-102428Critical· 9.8PoCJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
CVE-2026-88392High· 7.5PoCUnimall v4 is vulnerable to Directory Traversal in FileUploadController.local()
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
CVE-2026-88391Critical· 9.8PoCNorthstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / em…
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / em…
CVE-2026-105315Medium· 4.7PoC⚖ disputedA vulnerability has been found in django-haystack up to 3.3.0
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argu…
CVE-2026-63277High· 8.5PoCLibreOffice Calc can link a cell range to an external data source, and the link is saved in the document
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run…
CVE-2026-105291Medium· 4.3PoCA vulnerability was identified in feelec-yishu feelcrm-os 1.0.0
A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoin…
CVE-2026-105290High· 7.3PoCA vulnerability was determined in feelec-yishu feelcrm-os 1.0.0
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argu…
CVE-2026-105289Low· 3.5PoCA vulnerability was found in feelec-yishu feelcrm-os 1.0.0
A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Perfo…
CVE-2026-105288Medium· 4.3PoCA vulnerability has been found in feelec-yishu feelcrm-os 1.0.0
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the …
CVE-2026-105287Medium· 6.3PoCA flaw has been found in feelec-yishu feelcrm-os 1.0.0
A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument…
CVE-2026-105286Medium· 6.3PoCA vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455
A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in pat…
CVE-2026-105285Critical· 10.0PoCA security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455
A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_…
CVE-2026-105253High· 7.3PoCA vulnerability was determined in itsourcecode Online Admission System Project 1.0
A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be …
CVE-2026-105254Medium· 6.3PoCA vulnerability was identified in itsourcecode Online Admission System 1.0
A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remote…
CVE-2026-105284Critical· 10.0PoCA weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorizat…
CVE-2026-105247High· 7.3PoCA vulnerability was determined in SourceCodester Online Reviewer Management System 1.0
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course. Executing a manipulat…
CVE-2026-105314High· 7.5PoCPapermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python inte…
CVE-2026-105238High· 7.3PoCA flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes…
CVE-2026-105245Low· 3.7PoCA vulnerability has been found in sgl-project sglang up to 0.5.21
A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_server.py of the component HTTP Endpoint. Such manipulation of the argument api…
CVE-2026-105246High· 7.3PoCA vulnerability was found in SourceCodester Online Reviewer Management System 1.0
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argum…
CVE-2026-105231High· 7.3PoCA vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c
A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the com…
CVE-2026-105306Medium· 6.5PoCA flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server
A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is c…