CVE-2026-117000 to CVE-2026-117999

14 CVEs with public proof-of-concept exploits.

• CVE-2026-1171821 PoCAn authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to…
• CVE-2026-1171841 PoCAn issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to…
• CVE-2026-1175091 PoCcrownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal
• CVE-2026-1175101 PoCDexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal
• CVE-2026-1175111 PoCdesmondmorris node-tesseract Command Builder tesseract.js process os command injection
• CVE-2026-1175121 PoCoretnom23 php-travel-agency-system employee_insert.php unrestricted upload
• CVE-2026-1175131 PoCoretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection
• CVE-2026-1175141 PoCoretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection
• CVE-2026-1175151 PoCoretnom23 php-travel-agency-system traceapplication.php sql injection
• CVE-2026-1175161 PoCoretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
• CVE-2026-1175261 PoCreduxjs redux-devtools Remotedev Server evalAction code injection
• CVE-2026-1175321 PoCREDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
• CVE-2026-1175711 PoCWP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
• CVE-2026-1175721 PoCWP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter