Alta
ghsa-fc86-6rv6-2jpm
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 402
Restablecer filtros
Media
CVE-2026-100854
AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption
Alta
CVE-2026-42606
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
Media
CVE-2026-41891
CI4MS has a Deactivated User Session Bypass (active=0)
Alta
CVE-2026-29199
phpBB has Password Reset Link Poisoning via Host Header injection
Alta
CVE-2026-41670
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
Alta
CVE-2026-41669
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
Baja
CVE-2026-41659
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment
Media
CVE-2026-41658
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
Media
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
Alta
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Crítica
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Crítica
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Alta
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Media
CVE-2026-25525
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
Alta
CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
Alta
CVE-2026-41570
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
Media
CVE-2026-40479
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
Alta
CVE-2026-41064
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
Media
CVE-2026-40908
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
Alta
CVE-2026-32272
Craft Commerce hasVariant/hasProduct Blind SQL Injection
Alta
CVE-2019-25710
Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php
Baja
CVE-2026-40194
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
Baja
ghsa-xq4j-g85q-wf97
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.