Vulnerabilidades

El plugin Broadstreet para WordPress es vulnerable a cross-site scripting almacenado a través de la configuración de administrador en todas las versiones hasta la 1.53.1, inclusive, debido a una sanitización de entrada y un escape de salida insuficientes. Esto permite que atacantes autenticados, con permisos de nivel…

El plugin Broadstreet para WordPress es vulnerable a acceso no autorizado debido a una verificación de capacidad faltante en la acción AJAX create_advertiser en todas las versiones hasta la 1.53.1, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, creen anunciantes.

El plugin de Broadstreet para WordPress es vulnerable a la Exposición de Información Sensible en todas las versiones hasta la 1.53.1, inclusive, a través de la acción AJAX get_sponsored_meta(). Esto permite a atacantes autenticados, con acceso de nivel de suscriptor y superior, extraer datos de detalles comerciales…

WGDashboard is a dashboard for WireGuard VPN. Prior to 4.3.2, there are critical vulnerabilities affecting WGDashboard that, if exploited, could allow unauthorized parties to access the host file system without authentication. This vulnerability is fixed in 4.3.2.

Integer overflow in the UEFI firmware for the Slim Bootloader may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without…

Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstreet Ads: from n/a through <= 1.52.2.

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation. This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.

Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a…

The BJ Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `filter_images()` function in all versions up to, and including, 1.0.9. This is due to the use of regex-based HTML processing (`preg_replace`) that does not properly handle HTML attribute boundaries when replacing `src`…

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The…

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/<path:filename> is reachable without authentication and renders attacker-controlled template names, an unauthenticated…

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary directories as download…

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This…

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy",…

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general",…

Drupal avatar_uploader 7.x-1.0-beta8 contiene una vulnerabilidad de cross-site scripting reflejada que permite a atacantes no autenticados inyectar scripts maliciosos manipulando el parámetro file. Los atacantes pueden crear URL con cargas útiles de script en el parámetro file de avatar_uploader.pages.inc para…

El plugin de WordPress Download From Files versión 1.48 y anteriores contiene una vulnerabilidad de carga arbitraria de archivos que permite a atacantes no autenticados cargar archivos maliciosos explotando la acción AJAX fileupload. Los atacantes pueden enviar solicitudes POST al endpoint admin-ajax.php con la acción…

Balbooa Joomla Forms Builder 2.0.6 contiene una vulnerabilidad de inyección SQL no autenticada en el gestor de envío de formularios que permite a atacantes remotos ejecutar consultas SQL arbitrarias. Los atacantes pueden enviar solicitudes POST al componente com_baforms con cargas útiles JSON maliciosas en el…

pygeoapi es una implementación de servidor Python de la suite de estándares OGC API. Desde la versión 0.23.0 hasta antes de la versión 0.23.3, las solicitudes de ejecución de procesos de OGC API pueden usar el objeto subscriber para realizar solicitudes a servicios HTTP internos. Este problema ha sido parcheado en la…

pygeoapi es una implementación de servidor Python de la suite de estándares OGC API. Desde la versión 0.23.0 hasta antes de la versión 0.23.3, una vulnerabilidad de concatenación de rutas de cadena sin procesar en el plugin STAC FileSystemProvider de pygeoapi puede permitir que las solicitudes a colecciones basadas en…

Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18, the roadiz/openid package generates an OIDC nonce in OAuth2LinkGenerator::generate() and includes it in the authorization request sent to the identity provider, but never stores it and never…

Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, BaseHttpRequestHandler.get_temp_root(), BaseHttpRequestHandler._post() components.

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients…

Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented…

Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.