The embedded web interface of the device does not support HTTPS/TLS for
authentication and uses HTTP Basic Authentication. Traffic is encoded
but not encrypted, exposing user credentials to passive interception by
attackers on the same network.
The web management interface of the device allows the administrator
username and password to be set to blank values. Once applied, the
device permits authentication with empty credentials over the web
management interface and Telnet service. This effectively disables
authentication across all critical management channels, allowing any
network-adjacent attacker to gain full administrative control without
credentials.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.15.
The WP Quick Contact Us plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial of service (DoS) condition on the affected product by sending a specially crafted packet containing a specific command to the affected product.
CVE-2025-10314 is a high-severity vulnerability in Mitsubishi Electric Corporation's FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2. It arises from incorrect default permissions that allow a local attacker with limited privileges to replace service executable files or DLLs in the installation directory with malicious versions. Exploiting this flaw enables arbitrary code execution with system-level privileges, potentially leading to full system compromise, data disclosure, tampering, deletion, or denial of service. No user interaction is required, but local access with low privileges is necessary. The vulnerability affects confidentiality, integrity, and availability of affected systems. Although no known exploits are currently reported in the wild, the high CVSS score (8.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. DIGITA Efficiency Management System allows SQL Injection.
This issue affects DIGITA Efficiency Management System: through 03022026.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.
CVE-2026-24042 is a critical missing authorization vulnerability in Appsmith versions 1.94 and below. It allows unauthenticated users to execute unpublished, edit-mode actions by manipulating the POST /api/v1/actions/execute endpoint with the viewMode parameter. This bypasses the intended publish boundary, exposing sensitive data and enabling execution of development queries and APIs. The flaw can lead to unauthorized data access and unintended side effects. No official patch is available at the time of disclosure. The vulnerability has a CVSS score of 9.4, indicating high exploitability and impact without requiring authentication or user interaction. European organizations using Appsmith for internal tools and dashboards are at risk, especially those with publicly accessible apps. Immediate mitigation and monitoring are advised to prevent exploitation.
In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.
CVE-2026-22794 is a critical origin validation vulnerability in Appsmith versions prior to 1.93. The server improperly uses the Origin header from HTTP requests as the base URL for password reset and email verification links without validation. An attacker who can control the Origin header can craft emails with links pointing to a malicious domain, exposing authentication tokens and enabling account takeover. This vulnerability affects confidentiality, integrity, and availability of user accounts. It requires no privileges but does require user interaction to click the malicious link. The issue is fixed in Appsmith version 1.93. European organizations using vulnerable Appsmith versions should urgently update to mitigate risk. Countries with significant adoption of Appsmith and critical internal tooling deployments are most at risk.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vernon Systems Limited eHive Search ehive-search allows Reflected XSS.This issue affects eHive Search: from n/a through <= 2.5.0.
Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.
Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50.
The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2026-20893 is a high-severity origin validation vulnerability in Fujitsu Security Solution AuthConductor Client Basic V2 (version 2.0.25.0 and earlier). An attacker with login access to a Windows system running the affected software can exploit this flaw to execute arbitrary code with SYSTEM privileges and/or modify registry values. The vulnerability arises from improper origin validation, allowing privilege escalation without requiring user interaction. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is significant. European organizations using this Fujitsu security product on Windows endpoints are at risk, especially in sectors relying on Fujitsu hardware and software. Mitigation involves promptly updating to a fixed version once available, restricting local user privileges, and monitoring registry changes. Countries with strong Fujitsu market presence and critical infrastructure using these solutions, such as Germany, the UK, and the Netherlands, are most likely to be affected.
Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.19.
Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.
CVE-2025-68920 is a high-severity vulnerability in C-Kermit versions through 10.0 Beta.12 that allows a remote Kermit system to bypass authorization controls. This flaw enables unauthorized remote attackers to overwrite or retrieve arbitrary files on the local system without authentication or user interaction. The vulnerability stems from missing authorization checks (CWE-862) in the file transfer functionality of C-Kermit, potentially leading to full confidentiality and integrity compromise. Exploitation requires network access but no privileges or user interaction, and the vulnerability has a CVSS score of 8.9. Although no known exploits are currently reported in the wild, the impact on affected systems could be severe. European organizations using C-Kermit, especially in sectors relying on legacy or specialized communication protocols, are at risk. Mitigation involves applying patches once available, restricting network access to C-Kermit services, and monitoring for unusual file access patterns.
