Web Application Vulnerability

The Admin REST API is vulnerable to blind SQL injection due to improper input sanitization, allowing an authenticated administrator to extract database information or disrupt service.

AJ-Report versions 1.7.1 and earlier contain a hard-coded JWT secret, enabling token forgery and unauthenticated remote code execution via the testTransform endpoint.

The VikRentCar WordPress plugin contains a stored XSS vulnerability in the poplink parameter that is exploitable by unauthenticated attackers due to the public exposure of the vikwp_nonce token.

An unauthenticated arbitrary file upload vulnerability in Chamilo LMS versions 1.11.24 and earlier allows remote attackers to execute arbitrary code by uploading malicious web shells to the bigUpload.php endpoint.

CakePHP through version 5.4.3 contains an SQL injection vulnerability in its query building components that allows unvalidated collation values to trigger arbitrary SQL execution.

An unauthenticated access bypass vulnerability in the Drupal Commerce Core module is being actively exploited in the wild, leading to potential financial impact on affected e-commerce platforms.

ZITADEL versions 4.0.0 before 4.19.5 are vulnerable to host header injection, allowing unauthenticated attackers to redirect sensitive authentication-related emails to attacker-controlled infrastructure.

CVE-2022-29464 is an unauthenticated arbitrary file upload vulnerability in the WSO2 FileUploadServlet that enables remote code execution via directory traversal and malicious JSP deployment.

The Pie Register Premium WordPress plugin contains an unrestricted file upload vulnerability in the piereg_file_upload function that allows unauthenticated attackers to achieve remote code execution.

A critical unauthenticated arbitrary file upload vulnerability in the WordPress plugin midi-Synth (CVE-2026-1306) allows remote attackers to achieve full server compromise by uploading and executing arbitrary PHP files via the admin-ajax.php endpoint.

Visitor Management System 1.0 is vulnerable to a critical attack chain where SQL injection in 'pass.php' leads to plaintext credential theft and subsequent unrestricted file upload in 'admin_user_0.php' for remote code execution.

An authenticated SQL injection vulnerability in OpenSIS Community Edition 8.0-9.1 allows attackers to execute arbitrary SQL commands via unsanitized X-Forwarded-For headers.

The Labstack Echo web framework Proxy middleware incorrectly establishes a raw tunnel for WebSocket upgrades before validating upstream responses, allowing subsequent HTTP requests to bypass route-level authentication and authorization.

OPNMGR versions prior to 3.10.0 are vulnerable to an unauthenticated path traversal attack in the snyk_scan_progress.php file, allowing remote attackers to read sensitive .json files on the server.

Kavita versions 0.5.2 through 0.5.4.0 contain a path traversal vulnerability in the /api/image/cover-upload endpoint, allowing unauthenticated attackers to read arbitrary files.

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in the ShowMsg() function, allowing unauthenticated attackers to execute arbitrary system commands via a crafted HTTP Referer header.

Obot versions prior to 0.26.0 contain an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to harvest API keys by manipulating token requests.

Cherry Plugin for WordPress versions before 1.2.7 contain a path traversal vulnerability in the import-export module that allows unauthenticated attackers to read arbitrary files from the web server.

The NativeChurch WordPress theme before version 1.6.2 is vulnerable to unauthenticated path traversal via the download.php file parameter, allowing for the arbitrary download of sensitive system files.

Eclipse ioFog Controller versions 3.8.0 through 3.9.1 contain an authentication bypass vulnerability in operator WebSocket endpoints, allowing attackers to access exec and log sessions using self-minted bearer tokens.

CVE-2026-105949 is an authentication bypass vulnerability in Cruise Control due to improper security constraint configuration and flawed servlet path routing, allowing unauthenticated access to admin endpoints.

The Mercury server defaults to unauthenticated access and uses an ineffective blocklist mechanism, enabling remote, unauthenticated attackers to execute arbitrary Python code via the /api/kernels websocket endpoint.

An unauthenticated SQL injection vulnerability in the Registration-Edit Handler of the Events-Management-System allows remote attackers to compromise the backend database through unsanitized input parameters.

The light0011 CMS contains an improper access control vulnerability in its Captcha Validation component that allows remote attackers to manipulate authentication mechanisms.

PAYCOMET for WooCommerce versions 5.45 and earlier are vulnerable to reflected cross-site scripting (XSS), allowing unauthenticated attackers to execute arbitrary scripts in the context of a victim's session.

An authorization bypass vulnerability in the WP Booking System plugin allows authenticated subscribers to access sensitive booking email logs by manipulating request parameters, exposing PII.

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'quantity' and 'order_comments' parameters, allowing script injection by unauthenticated or low-privileged users.

LingGuo-Drama through commit 8a6924a is vulnerable to an Insecure Direct Object Reference (IDOR) flaw allowing unauthorized access, modification, and deletion of user projects.

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to access private knowledge bases by enumerating sequential ID values.

APIPark versions through 1.9.7-beta are vulnerable to an authorization bypass allowing authenticated team managers to manipulate team IDs to access, modify, or delete resources belonging to other teams.

Course-tencent-cloud through version 2.0.1 contains an authentication bypass vulnerability allowing attackers to brute force 6-digit verification codes due to a lack of rate limiting or invalidation.

Misaka Danmu Server versions 2.8.9 and earlier contain an authentication bypass vulnerability allowing unauthenticated attackers to modify sensitive configuration keys via the /api/ui/config-history/rollback endpoint.

The Vitepos plugin for WooCommerce is vulnerable to unauthenticated SQL injection via the 'src_by' parameter, potentially allowing unauthorized database information extraction.

An arbitrary file upload vulnerability in the Mang Board plugin for WordPress allows unauthenticated attackers to achieve remote code execution by bypassing extension validation.

The RSS Aggregator by Feedzy WordPress plugin is vulnerable to Stored Cross-Site Scripting via malicious RSS feed input, allowing unauthenticated attackers to execute arbitrary scripts in the context of the target site.

The kin-openapi library lacks cycle detection during runtime schema validation, allowing attackers to trigger an unrecoverable Go runtime stack overflow that terminates the entire host process.

The Link Library plugin for WordPress is vulnerable to unauthenticated time-based SQL injection via the 'link_url' parameter, enabling potential database information exfiltration.

Papermerge Core versions through 3.5.3 contain a missing authorization vulnerability allowing authenticated users to manipulate or process documents belonging to other users via predictable API endpoints.

An unauthenticated arbitrary file upload vulnerability in the Printcart Store (PCDesigner / NB Designer) WooCommerce plugin allows remote code execution via AJAX parameter manipulation.

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to unauthenticated remote code execution due to chained SQL injection and configuration file injection.

The fuint platform contains a missing authentication vulnerability in the /clientApi/order/detail endpoint, allowing unauthenticated attackers to retrieve sensitive customer order PII via enumeration.

Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11 contain a path traversal vulnerability in the fileManager component, allowing unauthenticated attackers to read sensitive files via the /rest/retrieveFileStream endpoint.

SourceCodester Simple Cafe Billing System 1.0 is vulnerable to an improper authorization flaw in the User Management component that allows remote attackers to manipulate the 'Type' argument during user saving operations.

SourceCodester Contact Tracing System 1.0 is vulnerable to an unrestricted file upload flaw in the /classes/Users.php component, allowing remote attackers to achieve arbitrary file uploads.

An authentication bypass vulnerability in the Online-Examination-System Session Handler allows remote attackers to gain unauthorized access via incorrect comparison of session cookies.

An unauthenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.9 allows attackers to exfiltrate data and manipulate database records by injecting Unicode characters into the api/autocomplete endpoint.

Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are susceptible to reflected XSS, allowing unauthenticated attackers to execute arbitrary JavaScript in authenticated sessions.

Servor versions 1.0.0 through 4.0.2 are vulnerable to path traversal via URL-encoded dot segments, allowing unauthenticated attackers to read arbitrary files and list directories.

An unrestricted file upload vulnerability in Thelia allows authenticated back-office users to achieve remote code execution by bypassing filename sanitization.

jshERP versions through 3.6 contain a missing authorization vulnerability in the UserController updateUser handler, allowing authenticated users to escalate privileges or modify other users' roles.

A remote SQL injection vulnerability in the Zen Cart PayPal IPN Handler component allows unauthenticated attackers to execute arbitrary SQL commands via the txn_id parameter.

CVE-2024-53345 is an arbitrary file upload vulnerability in the Car Rental Management System (versions 1.0-1.3) that allows authenticated attackers to achieve remote code execution via uploaded PHP web shells.

Studio-Saelix Sencho versions up to 0.94.1 contain an authentication bypass vulnerability (CVE-2026-108522) where improper processing of the X-Forwarded-For header allows remote attackers to circumvent login rate limits.

The GeoDirectory plugin for WordPress is vulnerable to unauthenticated local file inclusion (LFI) via the design_type parameter, allowing remote attackers to execute arbitrary PHP code.

A vulnerability in i-doit Pro (versions 25 and below) allows attackers to perform brute-force attacks on the admin-center, enabling the upload of malicious plugins to achieve remote code execution.

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload via the 'temporaryFileUploads' parameter in versions up to 3.1.8.9, enabling remote code execution.

A critical remote code execution vulnerability (CVE-2026-105857) in @payloadcms/plugin-form-builder allows unauthenticated attackers to execute arbitrary code via crafted form submissions.

A privilege escalation vulnerability in wger allows gym trainers to deactivate higher-privileged accounts, resulting in administrative lockout.

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

PickMall Lilishop up to version 4.2.4 contains an improper authorization vulnerability in the Mobile Binding component, allowing remote attackers to manipulate the Username argument to bypass authorization controls.

RainyGao DocSys versions up to 2.02.85 contain a remote SQL injection vulnerability in the Database Management component, allowing unauthenticated attackers to execute arbitrary SQL commands via the url argument.

The GeoDirectory WordPress plugin (<= 2.8.186) is vulnerable to SQL injection, allowing authenticated attackers to execute arbitrary database queries via improper coordinate sanitization in the geodir_gps_query_part function.

The ProfilePress plugin for WordPress (<= 4.17.4) is vulnerable to sensitive information exposure, allowing authenticated and unauthenticated attackers to extract user PII via crafted shortcode parameters.

The Ultimate Member WordPress plugin (<= 2.13.1) contains a stored XSS vulnerability in the form_id parameter, allowing unauthenticated attackers to execute arbitrary scripts in the administrator dashboard.

PictShare versions prior to 3.7.1 contain a vulnerability where insecure PRNG usage for delete_code generation allows unauthenticated attackers to delete arbitrary files from hosted instances.

The Smash Balloon Social Post Feed WordPress plugin is vulnerable to Stored XSS that can be escalated to arbitrary plugin installation and remote code execution.

Lektor versions 3.3.14 and 3.4.0b15 are vulnerable to CSRF in the admin API, allowing unauthenticated attackers to perform state-changing operations via malicious web pages.

A command injection vulnerability in the rubygem-foreman_remote_execution component allows authenticated attackers to execute arbitrary shell commands via the Satellite API.

The Forminator Forms plugin for WordPress is vulnerable to Stored XSS via the 'postdata-1[post-custom]' parameter in versions 1.57.2 and below, allowing unauthenticated attackers to execute arbitrary scripts.

An unauthenticated IDOR vulnerability in the LearnPress WordPress plugin allows unauthorized access to private course materials by manipulating the course and item identifiers in AJAX requests.

The Extendify plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'styles.blocks' parameter, allowing arbitrary script injection.

An unauthenticated arbitrary file read vulnerability (CVE-2024-58387) in Inspur Haiyue HCM Cloud allows remote attackers to disclose sensitive system files via the /api/model_report/file/download endpoint.

SourceCodester Online Reviewer Management System 1.0 contains a SQL injection vulnerability in the questions-view.php script, allowing remote attackers to execute unauthorized database queries.

An origin validation vulnerability in mcp-chrome-bridge versions 1.0.31 and earlier allows attackers to bypass CORS and perform unauthorized browser automation actions via malicious web pages.

Multiple critical vulnerabilities in Toptech TMS7 and TopHAT version 7.6.3 enable unauthenticated attackers to execute arbitrary code, manipulate databases via SQL injection, and gain unauthorized access to sensitive system files.

OrdaSoft Real Estate Manager for Joomla versions 6.7.8 and earlier are vulnerable to unauthenticated SQL injection via the 'order_field' parameter, enabling unauthorized database access and data exfiltration.

An unauthenticated remote command injection vulnerability in the aaPanel BaoTa File Merge Handler allows attackers to execute arbitrary system commands via the split_file_path parameter.

An unauthenticated path traversal vulnerability in the Khoj /home/ endpoint allows remote attackers to read arbitrary files from the server filesystem.

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'qty' parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative or user sessions.

An unauthenticated remote SQL injection vulnerability in the Drogon framework ORM Mapper allows attackers to manipulate database queries via the sort parameter.

QCMS versions up to 6.0.6 are vulnerable to remote SQL injection via the ID argument in the self_Tmp function, allowing attackers to execute arbitrary database commands.

The Save as PDF Plugin for WordPress up to version 4.6.1 is vulnerable to arbitrary function invocation via the pdf_created_callback shortcode attribute, allowing authenticated Contributor-level users to trigger sensitive data disclosure.

Chanjet CRM contains an unauthenticated SQL injection vulnerability in the webservice endpoint, enabling remote attackers to extract sensitive data via the site_id parameter.

Weaver E-cology is vulnerable to an unauthenticated SQL injection via the 'userIdentifiers' GET parameter, allowing attackers to extract sensitive database information including administrator credentials.

The Location Manager plugin for WordPress is vulnerable to unauthenticated SQL injection via REST API parameters, allowing remote attackers to extract sensitive database information.

A missing 'security@' guard in Grav's group blueprint allows an 'admin.users' operator to escalate privileges to 'admin.super' by modifying group access configurations.

SiYuan versions prior to 3.8.4 contain a cross-site scripting vulnerability in bookmark label rendering that enables remote code execution due to insecure Electron configuration.

Authenticated attackers can exploit improper record-level authorization checks in metasfresh ERP to perform unauthorized read, write, and delete operations on attachments and comments.

An authentication bypass vulnerability in lamp-cloud versions 5.10.0 and earlier allows unauthenticated attackers to exfiltrate sensitive JVM system properties via insecurely whitelisted API endpoints.

Froxlor versions before 2.2.5 contain a vulnerability allowing authenticated users to inject arbitrary Nginx or Apache configuration directives via unvalidated newline characters in subdomain redirect URLs.

The Sticky Chat Widget plugin for WordPress (<= 1.4.2) is vulnerable to unauthenticated SQL injection via the 'scw_save_form_data' AJAX action, allowing potential exfiltration of sensitive database information.

An authentication bypass vulnerability in the wp-module-data library used by multiple Newfold plugins allows unauthenticated attackers to forge administrative access tokens and take over WordPress sites.

The WPBot - AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 8.7.3, allowing unauthenticated attackers to execute arbitrary web scripts.

XenForo versions prior to 2.3.13 contain an OAuth2 authorization code reuse vulnerability (CVE-2026-73311) that allows attackers to obtain unauthorized token pairs by submitting previously used codes.

Lara Dashboard versions prior to 1.3.2 are vulnerable to arbitrary file upload via the core-upgrades endpoint, allowing unauthorized administrators to achieve remote code execution.

The Nokri Job Board WordPress theme (<= 1.6.4) is vulnerable to privilege escalation via a missing capability check in the 'nokri_account_member_permissions' function, allowing authenticated subscribers to escalate access.

A blind SQL injection vulnerability (CVE-2026-18198) in TAC Information Services GOLDENHORN ONEIT allows unauthenticated attackers to execute arbitrary SQL queries.

An unauthenticated SQL injection vulnerability in the Hospital Information System 1.0 allows remote attackers to execute unauthorized database queries via the Search parameter in addReq.php.

Checkmate versions through 3.11.0 contain an authorization bypass vulnerability (CVE-2026-85390) that allows read-only users to perform unauthorized administrative actions by accessing restricted routes.

Kill Bill versions 0.24.21 and earlier contain a security misconfiguration where authenticated users with minimal account:read privileges can perform unauthorized administrative actions.

An attacker with administrative page-editing permissions can achieve remote code execution in Grav versions prior to 2.0.7 by injecting arbitrary callables into page frontmatter, which are subsequently triggered by visitor requests.

Craft CMS versions prior to 5.10.11 contain an authorization bypass in the assets/move-asset endpoint, allowing authenticated users with insufficient permissions to move and delete arbitrary assets by supplying the force=1 parameter.

ShopEx ECShop versions up to 2.5.1 contain an unrestricted file upload vulnerability in the check_img_type function that allows unauthenticated remote attackers to upload malicious files via the pack_img argument.

Dokploy versions up to 0.29.7 are vulnerable to remote path traversal via the writeTraefikConfigInPath function, allowing attackers to access arbitrary files on the system.

Authenticated users without file upload permissions can exploit a missing authorization check in Kirby CMS to exhaust server storage via incomplete chunked file uploads, leading to denial-of-service.

C-MOR Video Surveillance versions up to 6.0104 are vulnerable to an unauthenticated directory traversal attack in the show-movies.pml component, allowing remote attackers to read arbitrary files.

ToolJet versions prior to 3.16.208 are vulnerable to broken access control, allowing authenticated builder-role users to perform unauthorized database operations across tenant boundaries.

SeaCMS versions 13.6 and earlier contain a code injection vulnerability in the search.php file, allowing remote attackers to execute arbitrary code via the searchtype parameter.

WWBN AVideo is vulnerable to a Server-Side Request Forgery (SSRF) bypass in the isSSRFSafeURL function due to improper normalization of hex-encoded NAT64 addresses.

The Sigma Forms Pro plugin for WordPress is vulnerable to unauthenticated remote code execution due to improper validation of file uploads and insecure capability management within the handle_form_submission function.

An unauthenticated remote code execution vulnerability (CVE-2019-11581) exists in the 'ContactAdministrators' form of Atlassian Jira Server due to insecure Velocity template rendering of the 'subject' parameter.

Qwen-Agent version 0.0.34 and earlier contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to force the server to perform arbitrary internal HTTP requests and exfiltrate metadata service content.

Yamcs versions prior to 5.11.13 contain an unauthenticated directory traversal vulnerability in the HTTP request handling components that allows remote attackers to read arbitrary files from the underlying host.

An authenticated user in a multi-company Snipe-IT deployment can exploit an authorization flaw in the asset maintenance update API to re-parent records to assets owned by other companies, breaking tenant isolation.

An insufficient permission check in the Pimcore studio-backend-bundle allows authenticated users with standard object-editing privileges to create class definitions, leading to unauthorized schema modification and server-side file creation.

The TranslatePress plugin for WordPress is vulnerable to unauthenticated stored XSS through improper sanitization of comment data, allowing attackers to inject persistent malicious scripts.

CVE-2026-23489 is a blind remote code execution vulnerability in the GLPI Fields plugin (<= 1.23.2) that allows authenticated attackers to execute arbitrary PHP code via the dropdown-generation feature.

A vulnerability in Baserow's Application Builder allows unauthenticated attackers to bypass permission checks and retrieve sensitive data by leveraging improperly handled access control logic.

APITable versions up to 1.13.0-beta.1 contain an authentication bypass vulnerability in the InternalUserController, allowing unauthenticated attackers to permanently delete user accounts currently in a cooling-off period.

ClipBucket V5 versions 5.5.1 through 5.5.3-#153 contain an OS command injection vulnerability in the web installer, allowing unauthenticated remote code execution via the php_cli_filepath parameter.

An improper authorization vulnerability (CVE-2026-71504) in Dolibarr prior to version 24.0.0 allows authenticated users to overwrite the credentials of any account via the Members REST API.

Ghostwriter versions prior to 7.1.2 are vulnerable to an authorization bypass via the report template swap endpoint, allowing authenticated attackers to enumerate and exfiltrate sensitive client-scoped template contents.

An unauthenticated remote code execution vulnerability (CVE-2026-78154) in open-wearables versions 0.6.2 and earlier allows attackers to bypass authentication in the invitation code redemption endpoint.

An unauthenticated SQL injection vulnerability in the Barangay Resident Profiling Management System version 1.0 allows remote attackers to execute arbitrary database queries via the 'Search' argument in residents.php.

WWBN AVideo versions through commit 9c39d8c8 contain a CSRF vulnerability in the releaseVideoNow.json.php endpoint that allows unauthenticated attackers to force administrative users to publish embargoed videos.

The Headroom LLM proxy improperly derives memory ownership from the unauthenticated 'x-headroom-user-id' request header, allowing attackers to perform unauthorized read and write operations on arbitrary user LLM memory.

ICEcoder version 8.1 contains a critical vulnerability allowing unauthenticated remote code execution via a crafted HTTP POST request to the terminal endpoint that chains authentication and CSRF bypasses.

The Gallery by BestWebSoft plugin for WordPress up to version 4.7.9 contains an SQL injection vulnerability via the '_gallery_order_{post_id}' parameter allowing authenticated attackers with Editor-level access to extract database information.

Evergreen versions up to 3.17-beta1 contain a SQL injection vulnerability in the OpenSRF service, allowing remote unauthenticated attackers to execute arbitrary database queries.

SourceCodester Class and Exam Timetabling System 1.0 contains an unauthenticated SQL injection vulnerability in edit_teacher.php that allows remote attackers to compromise database integrity.

Cockpit CMS versions 2.14.0 and prior are vulnerable to authenticated command injection via malicious filenames processed by the FFmpeg integration.

Authenticated users can achieve remote code execution in Grav CMS versions prior to 2.0.13 by exploiting improper input validation in the Flex Objects plugin to upload and execute arbitrary PHP files.

The Grav API plugin before version 1.0.13 fails to enforce API key scope restrictions in ConfigController, enabling remote code execution via injected scheduler commands.

An API key scope-cap bypass in the Grav API plugin allows attackers with restricted keys to execute server-side templates via Server-Side Template Injection.

Budibase versions prior to 3.40.0 are vulnerable to NoSQL injection in the MongoDB datasource due to improper handling of user-supplied parameters, allowing unauthorized data access and potential server-side execution.

The GeoDirectory WordPress plugin contains an arbitrary file deletion vulnerability (CVE-2026-19091) allowing authenticated attackers to delete critical files and potentially achieve remote code execution.

DB-GPT version 0.8.1 is vulnerable to an unauthenticated path traversal attack allowing remote code execution via a crafted user_id HTTP header.

CodeIgniter Framework versions prior to 4.7.4 contain a path traversal vulnerability in the UploadedFile::move() method that allows attackers to write files to arbitrary filesystem locations when unsanitized client filenames are processed.

An unauthenticated stored cross-site scripting vulnerability in FormGent versions 1.9.2 and below allows attackers to inject malicious scripts into form fields that execute upon viewing.

The WordPress File Manager plugin (versions 6.0-6.9) contains an arbitrary file deletion vulnerability allowing authenticated attackers to delete critical server files and achieve remote code execution.

The Search Analytics for WP plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in the process_bulk_action function that allows authenticated administrators to be tricked into deleting arbitrary search-term records.

A publicly exploitable SQL injection vulnerability in ESAFENET CDG allows unauthenticated remote attackers to execute arbitrary database queries via the keyid parameter.

WebPros has issued a security advisory addressing HTTP request smuggling and database privilege escalation vulnerabilities in cPanel and WP Squared products.

OpenEMR versions 8.2.0 and earlier are vulnerable to authenticated remote code execution via SQL injection and unsafe eval() calls in the document category tree component.

Thumbor version 7.7.7 and earlier is vulnerable to arbitrary file read via a path traversal flaw in file_loader.py, where security checks are performed before decoding percent-encoded traversal sequences.

Wolf CMS versions up to 0.8.3.1 contain a remote code execution vulnerability in the FileManagerController allowing authenticated users with specific permissions to upload and execute arbitrary PHP files.

An authorization flaw in the Subscriptions for WooCommerce WordPress plugin allows authenticated users with shop manager privileges to remotely install and activate arbitrary plugins.

Google Drive for WordPress 2.2 is vulnerable to path traversal (CVE-2018-25326), allowing unauthenticated attackers to read arbitrary files by injecting directory traversal sequences in the file_name parameter.

A remote, anonymous attacker can exploit a vulnerability in Pega Platform to perform a cross-site scripting (XSS) attack, potentially leading to session hijacking or malicious script execution in a user's browser.

A reflected cross-site scripting (XSS) vulnerability exists in Gosoft Software Industry and Trade Ltd. Co.'s Proticaret E-Commerce software (versions v5.0.0 before V 6.0.1767.1383) due to improper neutralization of input during web page generation, potentially allowing attackers to execute arbitrary JavaScript in a user's browser.

A buffer overflow vulnerability exists in Shenzhen Libituo Technology LBT-T300-HW1 version 1.2.8 and earlier, allowing remote attackers to execute arbitrary code by manipulating the Channel/ApCliSsid argument in the start_lan function of the /apply.cgi file.