Low
CVE-2026-45710
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
High
CVE-2026-45263
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
Critical
CVE-2026-45262
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
High
CVE-2026-55372
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
High
CVE-2026-54065
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
High
CVE-2026-54064
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
High
CVE-2026-49259
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
High
CVE-2026-48118
NukeViet: Unauthenticated Reflected XSS in Comment Module
High
ghsa-qv4m-m73m-8hj7
NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)
Medium
CVE-2026-53639
Sylius: IDOR on Shop Payment Request API endpoints
Critical
CVE-2026-52778
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
Critical
CVE-2026-52777
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
Medium
CVE-2026-52774
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes
Medium
CVE-2026-52773
YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`
Medium
CVE-2026-52772
YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))
High
CVE-2026-52771
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
High
CVE-2026-52767
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
Medium
CVE-2026-52763
YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read
High
CVE-2026-52762
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
Low
CVE-2026-56394
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
Medium
CVE-2026-55793
Craft CMS: Stored XSS via Structure entry title in table view
Medium
CVE-2026-55792
Craft CMS: Sensitive File Disclosure / Server-Side File Read
High
CVE-2026-55790
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
High
CVE-2026-50281
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.