News & Sicurezza

CVE ID : CVE-2025-11950 Published : Feb. 27, 2026, 1:16 p.m. | 3 hours, 56 minutes ago Description : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KNOWHY Advanced Technology Trading Ltd. Co. EduAsist allows Reflected XSS.This issue affects EduAsist: through 27022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-11252 Published : Feb. 27, 2026, 1:16 p.m. | 3 hours, 56 minutes ago Description : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection.This issue affects windesk.Fm: through 27022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerability in Pro3W CMS software Vulnerability in Pro3W CMS software CVE ID CVE-2025-15498 Publication date 27 February 2026 Vendor Pro3W Product Pro3W CMS Vulnerable versions All through 1.2.0 Vulnerability type (CWE) Improper Neutr ... Read more Published Date: Feb 27, 2026 (2 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-15498

The Cyber Express Weekly Roundup: Space Security, Malware & Regulatory Alerts In this week’s edition of The Cyber Express weekly roundup, some interesting news and cybersecurity stories share an interesting shift in the cyber domain. Critical developments span space cybersecuri ... Read more Published Date: Feb 27, 2026 (2 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20127 CVE-2022-20775

CVE ID : CVE-2026-2831 Published : Feb. 27, 2026, 12:16 p.m. | 4 hours, 56 minutes ago Description : The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Severity: 4.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-24351 Published : Feb. 27, 2026, 12:16 p.m. | 4 hours, 56 minutes ago Description : PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-24352 Published : Feb. 27, 2026, 12:16 p.m. | 4 hours, 56 minutes ago Description : PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-24350 Published : Feb. 27, 2026, 12:16 p.m. | 4 hours, 56 minutes ago Description : PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payload, which will be executed when a victim clicks the link associated with the uploaded image. In version 5.9.0-rc7 clicking the link associated with the uploaded image doesn't execute malicious code but directly accessing the file will still execute the embedded payload. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection.This issue affects E-Commerce Platform: through 27022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2025-11251 Published : Feb. 27, 2026, 12:16 p.m. | 4 hours, 56 minutes ago Description : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection.This issue affects E-Commerce Platform: through 27022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerabilities in PluXml CMS software Vulnerabilities in PluXml CMS software CVE ID CVE-2026-24350 Publication date 27 February 2026 Vendor PluXml Product PluXml CMS Vulnerable versions 5.8.21 and 5.9.0-rc7 Vulnerability type (CWE) Improp ... Read more Published Date: Feb 27, 2026 (3 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-24352 CVE-2026-24351 CVE-2026-24350

CVE ID : CVE-2026-1434 Published : Feb. 27, 2026, 11:16 a.m. | 5 hours, 56 minutes ago Description : Omega-PSIR is vulnerable to Reflected XSS via the lang parameter. An attacker can craft a malicious URL that, when opened, causes arbitrary JavaScript to execute in the victim’s browser. This issue was fixed in 4.6.7. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...