|
1701
|
8.1 |
HIGH
Network
|
-
|
-
|
CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded …
|
CWE-20
CWE-345
CWE-601
CWE-784
Improper Input Validation
Insufficient Verification of Data Authenticity
Open Redirect
Reliance on Cookies without Validation and Integrity Checking in a Security Decision
|
CVE-2026-45055
|
2026-05-15 01:49 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1702
|
9.1 |
CRITICAL
Network
|
-
|
-
|
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Inv…
|
CWE-94
CWE-1336
Code Injection
Improper Neutralization of Special Elements Used in a Template Engine
|
CVE-2026-45714
|
2026-05-15 01:49 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1703
|
8.3 |
HIGH
Network
|
-
|
-
|
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.
|
CWE-93
CRLF Injection
|
CVE-2026-32993
|
2026-05-15 01:49 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1704
|
8.1 |
HIGH
Network
|
-
|
-
|
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.
|
CWE-89
SQL Injection
|
CVE-2026-29206
|
2026-05-15 01:49 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1705
|
7.1 |
HIGH
Network
|
-
|
-
|
Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.
|
CWE-863
Incorrect Authorization
|
CVE-2026-32991
|
2026-05-15 01:49 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1706
|
4.8 |
MEDIUM
Network
|
-
|
-
|
Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability. A man-in-the-middle attacker may access and modify commun…
|
CWE-319
Cleartext Transmission of Sensitive Information
|
CVE-2026-41281
|
2026-05-15 01:49 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1707
|
7.1 |
HIGH
Network
|
-
|
-
|
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
|
CWE-89
SQL Injection
|
CVE-2026-46445
|
2026-05-15 01:49 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1708
|
7.1 |
HIGH
Network
|
-
|
-
|
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
|
CWE-89
SQL Injection
|
CVE-2026-46446
|
2026-05-15 01:49 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1709
|
- |
|
-
|
-
|
Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitizat…
|
CWE-79
Cross-site Scripting
|
CVE-2026-5790
|
2026-05-15 01:46 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1710
|
- |
|
-
|
-
|
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated at…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-5798
|
2026-05-15 01:46 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
