Base de données CVE

CVE-2024-58396 Élevée · 8.7 · 22/10/2026

YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /c...

CVE-2024-58393 Élevée · 8.8 · 22/10/2026

i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can sen...

CVE-2022-51024 Élevée · 8.7 · 22/10/2026

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to...

CVE-2022-51023 Élevée · 8.8 · 22/10/2026

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=in...

CVE-2022-51022 Élevée · 8.8 · 22/10/2026

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the file...

CVE-2022-51021 Élevée · 8.8 · 22/10/2026

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-...

CVE-2021-48017 Élevée · 8.7 · 22/10/2026

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id...

CVE-2021-48015 Élevée · 8.7 · 22/10/2026

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/sh...

CVE-2021-48013 Élevée · 8.7 · 22/10/2026

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GE...

CVE-2019-25779 Élevée · 8.7 · 22/10/2026

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:/...

CVE-2019-25778 Élevée · 8.8 · 22/10/2026

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests...

CVE-2018-25439 Élevée · 8.7 · 22/10/2026

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with b...

CVE-2018-25438 Élevée · 8.7 · 22/10/2026

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can...

CVE-2017-20289 Élevée · 7.7 · 22/10/2026

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in...

CVE-2017-20287 Élevée · 8.7 · 22/10/2026

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can...

CVE-2026-114664 Élevée · 7.1 · 22/10/2026

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL que...

CVE-2026-114663 Élevée · 8.6 · 22/10/2026

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a...

CVE-2026-114662 Élevée · 8.6 · 22/10/2026

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POS...

CVE-2026-114658 Élevée · 8.7 · 22/10/2026

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting...

CVE-2026-114642 Élevée · 7.0 · 22/10/2026

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for anot...

CVE-2026-114640 Élevée · 7.0 · 22/10/2026

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redire...

CVE-2026-114639 Élevée · 7.0 · 22/10/2026

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backen...

CVE-2026-114638 Élevée · 7.0 · 22/10/2026

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attacker...

CVE-2026-114637 Élevée · 7.0 · 22/10/2026

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend conn...

CVE-2026-114636 Élevée · 7.0 · 22/10/2026

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.