Web-Vulnerability

The Contact Form Extender for Divi Builder plugin for WordPress contains an arbitrary file deletion vulnerability in versions 1.0.6 and below that allows unauthenticated attackers to delete sensitive files via the cfefd_remove_uploaded_file function.

Control Web Panel versions prior to 1.12 contain an execution after redirect vulnerability in the user panel authentication flow that allows attackers with a valid username to bypass authentication and achieve unauthorized code execution.

AdminNeo versions 4.6.0 through 5.5.0 contain a vulnerability where unsanitized X-Forwarded-Prefix headers allow cookie attribute injection, potentially leading to session hijacking and credential theft.

The PPWP Password Protect Pages plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via improper input sanitization in shortcode attributes, allowing script injection into pages.

CVE-2026-29057 is an HTTP request smuggling vulnerability in Next.js allowing attackers to smuggle secondary requests to internal backends via chunked transfer-encoding desynchronization.

An authenticated instructor-level user can exploit a Zip Slip vulnerability in MarkUs assignment configuration uploads to write arbitrary files and achieve remote code execution.

Tandoor Recipes versions before 2.7.0 are vulnerable to SSRF in the Pestle importer, allowing authenticated low-privileged users to force server-side GET requests to arbitrary internal or external targets.

A contributor PHP object injection vulnerability exists in the Dynamic QR Code - generator WordPress plugin, affecting versions 1.0.1 and earlier.

Auction Nudge - Your eBay on Your Site versions 8.4.0 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability.

The Extra Fees Plugin for WooCommerce versions 4.4.0 and below contains a contributor-level PHP object injection vulnerability.

The Foxit official website exposes third-party authorization credentials within its client-side JavaScript code, allowing unauthorized parties to potentially harvest and misuse sensitive information.

A server-side request forgery (SSRF) vulnerability in the Foxit HTML-to-PDF conversion service allows bypass of internal network restrictions via crafted ZIP-formatted input.

Codeastro Internet Banking System 2.0.0 contains a stored XSS vulnerability in the pages_add_acc_type.php component that allows authenticated attackers to inject malicious JavaScript, potentially leading to session hijacking.

Highcharts Dashboards parses fullscreen labels as HTML, allowing an attacker who controls the Dashboards language options to execute script in the origin of the page hosting the dashboard.

The DSGVO All in one for WP plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of comment content when specific integration settings are enabled.

CVE-2025-0133 is a reflected Cross-Site Scripting vulnerability in PAN-OS GlobalProtect portal and gateway login pages that allows arbitrary JavaScript execution via the user query parameter.

The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.

n8n workflow nodes for Microsoft Outlook and SharePoint contain an OData $filter injection vulnerability allowing unauthorized data access and modification.

The VikRentCar plugin for WordPress (<= 1.4.8) contains a CSRF vulnerability in the condtext_update_tmpl function that permits unauthenticated attackers to achieve remote code execution by injecting PHP code into template files.

The MxChat AI Chatbot plugin for WordPress is vulnerable to unauthenticated stored DOM-based XSS, allowing script injection via the feedback parameter that executes in an administrator's session.

TinyMCE is vulnerable to stored Cross-Site Scripting (XSS) via the media plugin, allowing attackers to inject malicious scripts through the data-mce-object attribute before sanitization occurs.

Better Auth is vulnerable to an authentication bypass where OAuth sign-in state can be used as a valid Magic Link token, allowing unauthenticated attackers to hijack user accounts or create unauthorized verified accounts.

NVIDIA NeMo Agent Toolkit is vulnerable to a SQL injection flaw that may allow an unauthorized attacker to perform data tampering, cause a denial of service, or facilitate unauthorized information disclosure.

The School Fees Management System version 1.0 is vulnerable to stored cross-site scripting (XSS) via the tname parameter in the new_term administrative component.

An authorization bypass vulnerability in Simple Machines Forum 3.0 allows authenticated users to access other members profile settings, presenting an account takeover risk via unauthorized password changes.

An authorization bypass vulnerability in the Admin Interface of code-projects Simple Content Management System 1.0 allows remote attackers to manipulate the addnews argument to perform unauthorized actions.

Onyx Craft versions through 5.0.0 contain a stored Cross-Site Scripting vulnerability in the output preview panel caused by insecure iframe sandbox configuration, allowing malicious preview content to access the parent document DOM.

An authenticated SQL injection vulnerability in the Anuko Time Tracker puncher component allows attackers to exfiltrate database credentials via the date parameter.

An authentication bypass vulnerability in danmu_api before 1.21.7 allows unauthenticated attackers to modify server environment configurations and facilitate SSRF through crafted POST requests to environment management endpoints.

SourceCodester Performance Indicator System 1.0 contains an SQL injection vulnerability in the 'Contact' argument of '/opils/staff/adddealer.php', which can be triggered remotely.

LibreNMS versions through 24.9.1 are vulnerable to a reflected cross-site scripting (XSS) attack via the routing module, enabling remote attackers to execute arbitrary JavaScript in the context of an authenticated user session.

OpenPetra version 2023.02 contains an unauthenticated XSS vulnerability in the serverMFinDev.asmx component that allows attackers to steal user session cookies.

Vitejs and Voidzero Vite contain a vulnerability (CVE-2026-39636) in the WebSocket-based fetchModule call that allows unauthenticated attackers to bypass filesystem checks and read arbitrary files by injecting file:// URLs into WebSocket payloads.

The Ally Web Accessibility plugin for WordPress is vulnerable to unauthenticated time-based blind SQL injection in the get_global_remediations() method.

OpenCATS versions prior to 0.12.0 are vulnerable to a stored cross-site scripting flaw that allows authenticated users to execute arbitrary JavaScript in the sessions of other users, including administrators.

Intermesh Group-Office versions 3.3.0 through 3.5.4 contain an unauthenticated path traversal vulnerability in compress.php, allowing remote attackers to read arbitrary files via directory traversal sequences.

The Broadstreet Ad Widget WordPress plugin (versions 2.2.0 through 2.11.9) is vulnerable to authenticated local file inclusion via directory traversal in the 'step' parameter, allowing for arbitrary PHP code execution.

YiShaAdmin versions 2.2 through 3.1 contain an unauthenticated path traversal vulnerability in the DownloadFile endpoint, allowing attackers to read or delete arbitrary files via manipulated parameters.

Xxyopen Novel version 3.5.0 contains a DOM-based Cross-Site Scripting vulnerability in its comment module, allowing attackers to execute arbitrary JavaScript in the context of other users' sessions.

The Jane Menu WordPress plugin prior to 1.5.1 contains a vulnerability allowing unauthenticated attackers to perform Stored Cross-Site Scripting via improper capability and nonce checks in a form handler.

EG Secure Solutions SiteGuard Server Edition is susceptible to an OS command injection vulnerability, allowing remote attackers to execute arbitrary commands with root or SYSTEM privileges.

FooSun DotNetCMS versions 1.0 and 2.0 contain an unauthenticated SQL injection vulnerability in the CityId parameter of the /user/City_ajax.aspx endpoint, which is being actively exploited to extract database information.

ApostropheCMS versions prior to 4.33.0 contain a vulnerability in the Rich Text CSV conversion route allowing unauthenticated attackers to trigger disk exhaustion through unmanaged temporary file accumulation.

A Cross-Site Request Forgery (CSRF) vulnerability in the VikRentCar WordPress plugin (versions 1.4.8 and earlier) allows unauthenticated attackers to perform unauthorized administrative actions.

A logic error in the Stormshield Network Security (SNS) dynamic data file signature verification routine allows attackers to bypass validation and inject unauthenticated updates during the autoupdate process.

Uniong WebITR contains an insecure deserialization vulnerability, CVE-2026-113404, allowing authenticated remote attackers to execute arbitrary code via malicious serialized data.

Roundcube Webmail versions prior to 1.6.20 and 1.7.5 are vulnerable to IMAP command injection via CRLF sequences in the _uid parameter, allowing authenticated remote attackers to execute arbitrary IMAP commands.

Coze Studio versions up to 0.5.1 are vulnerable to an IDOR flaw in workflow.go allowing authenticated users to perform unauthorized operations on other tenants workflows.

CVE-2022-34961 is a stored cross-site scripting vulnerability in Open Source Social Network version 6.3 that allows authenticated attackers to execute malicious scripts via the location input field in the Users Timeline module.

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting (XSS) vulnerability allowing authenticated attackers to inject and execute malicious JavaScript.

A default credentials vulnerability in FlyCms through commit edfdf724 allows unauthenticated attackers to gain administrative access using the flycms account and admin123 password.

A path traversal vulnerability in the MapSVG plugin, tracked as CVE-2026-111398, allows unauthenticated attackers to read arbitrary files from the hosting server.

The Quiz Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input sanitization, potentially allowing attackers to execute arbitrary scripts in a user’s browser.

An unauthenticated remote SQL injection vulnerability (CVE-2026-111990) exists in the Appointment Cancellation Handler of the kishan0725 Hospital Management System.

WhoDB versions prior to 0.135.0 are vulnerable to path traversal via DuckDB filesystem functions in the query editor, enabling remote unauthenticated file read and write access.

CVE-2026-110897 is a stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Lite for Beaver Builder WordPress plugin that allows unauthenticated or low-privileged attackers to execute arbitrary scripts in a victim's browser session.

CVE-2026-110383 is an authorization bypass vulnerability in the Electronic Signature Add-on for Fluent Forms that permits attackers to manipulate access control levels due to improper user-controlled key handling.

A stored cross-site scripting (XSS) vulnerability (CVE-2026-110382) in the Simply Schedule Appointments WordPress plugin allows unauthenticated or low-privileged users to inject malicious scripts into administrative pages.

CVE-2026-109894 is a critical SQL injection vulnerability in the Arraytics Booktics plugin that allows unauthenticated attackers to execute arbitrary database queries.

An unauthenticated stored XSS vulnerability in the User Registration & Membership plugin allows attackers to inject arbitrary scripts via the checkbox field due to missing nonce validation.

The User Registration & Membership plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution due to insufficient sanitization of the HTTP_REFERER header.

An unauthenticated Stored Cross-Site Scripting vulnerability in The EU VAT Assistant for WooCommerce plugin (<= 2.1.30.260413) allows attackers to inject malicious scripts that execute in the administrator's context, potentially leading to account takeover.

The LearnPress plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via the 'checkout-email' parameter, allowing remote attackers to trigger insecure deserialization.

Authenticated users can exploit a blind Server-Side Request Forgery vulnerability in Tandoor Recipes versions prior to 2.6.10 by manipulating AI provider URL inputs to map internal network resources.

Authenticated users can exploit an SQL injection vulnerability in the WebVella ERP EQL query API to exfiltrate sensitive data from user and role tables.

Chaskiq version 2.0.3 and earlier contains a server-side request forgery vulnerability in the createUrlUpload GraphQL mutation, allowing unauthenticated attackers to access internal resources including cloud metadata services.

AllData versions 0.7.1 and earlier are vulnerable to unauthenticated JDBC injection via the /jobJdbcDatasource/test endpoint, enabling remote attackers to perform arbitrary file read via the MySQL allowLoadLocalInfile parameter.

WhaTicket Community through commit cf04795 is vulnerable to an authentication bypass via the /auth/signup endpoint, allowing unauthenticated attackers to self-register with administrator privileges.

The WP Sessions Time Monitoring Full Automatic WordPress plugin up to version 1.1.5 is vulnerable to stored XSS via multiple input parameters, allowing unauthenticated attackers to execute arbitrary scripts in the context of user sessions.

The Search Regex WordPress plugin version 3.5 is vulnerable to PHP Object Injection, allowing authenticated users with subscriber access to achieve remote code execution via a POP chain.

The Simply Schedule Appointments WordPress plugin is vulnerable to stored XSS via the 'status' parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session.

An arbitrary file upload vulnerability in the Mang Board plugin for WordPress allows unauthenticated attackers to achieve remote code execution by bypassing extension validation.

The Backuply plugin for WordPress is vulnerable to second-order SQL injection, allowing authenticated attackers to achieve privilege escalation through malicious backup restoration.

An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.

A critical reflected XSS vulnerability (CVE-2026-102989) in TanStack Start server-functions allows unauthenticated attackers to execute arbitrary JavaScript in the context of the application origin.

CVE-2026-3786 is a high-severity SQL injection vulnerability in Easycms version 1.6 and earlier that allows remote attackers to execute arbitrary database commands via the _order parameter.

The Mang Board WP plugin for WordPress through version 2.4.0 is vulnerable to stored cross-site scripting (XSS) via the 'data_type' parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) via the 'order_email' parameter due to insufficient input validation.

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery via insecure Host header processing, allowing unauthenticated attackers to bypass URL allowlists and perform unauthorized requests.

Portkey AI Gateway versions 1.14.0 through 1.15.2 are vulnerable to unauthenticated SSRF via the x-portkey-custom-host header, allowing attackers to access internal loopback and Docker host services.

CVE-2026-15176 is a heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source that allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code by sending crafted HTTP requests.

The JTL-Connector for WooCommerce WordPress plugin is vulnerable to unauthenticated remote code execution via a flaw in session handling and file validation.

The Snazzy Social Media Feed WordPress plugin (up to version 2.5) is susceptible to arbitrary file upload and remote code execution via insufficient sanitization in the standalone save-to-cache.php script.

An insecure direct object reference vulnerability in FastBee versions through 2.1.0 allows authenticated low-privileged users to access and modify devices belonging to other tenants.

A remote SQL injection vulnerability in SourceCodester Online Reviewer System 1.0 allows attackers to execute arbitrary SQL commands via the login endpoint.

An unrestricted file upload vulnerability in the Extension Check component of phpwcms allows remote unauthenticated attackers to upload arbitrary files via the POST_name parameter.

An unauthenticated SQL injection vulnerability in the Online-Appointment-Booking-System Admin CRUD endpoint allows remote attackers to execute arbitrary SQL commands via the cid or did parameters.

Wazuh versions 3.9.0 through 4.14.7 are vulnerable to an arbitrary file overwrite attack in MasterHandler that allows cluster workers to gain root remote code execution by modifying critical configuration files.

SourceCodester Library Management System 1.0 is vulnerable to an unrestricted file upload flaw via the 'image' argument in 'admin/add_admin.php', potentially enabling remote code execution.

SourceCodester E-Learning System 1.0 contains an unrestricted file upload vulnerability in the save_users function, allowing remote attackers to upload arbitrary files to the server.

SourceCodester Performance Indicator System 1.0 contains an unauthenticated SQL injection vulnerability via the prodcategory parameter, allowing remote attackers to execute arbitrary SQL queries.

IBM i versions 7.3 through 7.6 contain an improper data sanitization vulnerability in the HTTP Server Administration interface that allows remote authenticated attackers to execute arbitrary code or exfiltrate sensitive data.

LibreNMS versions prior to 26.9.0 are vulnerable to LDAP filter injection, allowing unauthenticated attackers to bypass authentication and gain administrative access via crafted HTTP Basic Authorization headers.

Adminer versions prior to 6.1.1 are vulnerable to remote code execution (RCE) where authenticated SQLite users can bypass security restrictions using UTF-8 byte-order marks to inject and execute PHP code.

Open WebUI versions 0.7.0 through 0.11.3 contain a cross-origin message handling vulnerability that allows unauthenticated websites to steal a user's session JWT via a crafted postMessage payload.

The user_ok function in the Netcore NR268 CGI execution component contains an authentication bypass vulnerability, CVE-2026-108907, which allows remote attackers to gain unauthorized access.

LogicalDOC Community Edition versions 9.3 and earlier are vulnerable to authenticated OS command injection via maliciously crafted Velocity templates within the DocumentService.sendAsEmail function.

A SQL injection vulnerability in the login processing component of the krupalshah EmployeeRecruitmentSystem allows remote attackers to execute arbitrary SQL commands via the email or password fields.

A SQL injection vulnerability in the jackq XCMS password recovery function allows remote attackers to execute arbitrary database queries via the email parameter.

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability (CVE-2026-108853) that allows authenticated attackers to delete unauthorized tenants' applications.

GoatCounter versions 2.7.0 and earlier are vulnerable to a mass assignment flaw in the userPrefSave handler, enabling authenticated users to escalate privileges to administrator status.

OpenSpug Spug versions 3.4.0, 4.0.1, and earlier contain a remote OS command injection vulnerability in the File Transfer component, which is currently subject to public exploit availability.

JeecgBoot versions 3.9.5 and earlier contain a missing authorization vulnerability in the SysLogController that allows low-privileged authenticated users to delete system audit logs via a specially crafted request.

OpenRefine versions up to 3.10.1 are vulnerable to a cross-site request forgery attack in the get-rows command that permits remote attackers to execute arbitrary Jython facet expressions and achieve system command execution.

Spotweb versions 1.5.8 and earlier are vulnerable to remote code execution through the NZB handler, triggered by maliciously crafted Usenet spot titles.

An unauthenticated stored XSS vulnerability in WP Photo Album Plus <= 9.3.03.002 allows attackers to inject malicious scripts via REQUEST_URI session history due to insecure output rendering.

An unauthenticated IDOR vulnerability in the WebToffee WooCommerce PDF Invoices plugin allows attackers to retrieve sensitive customer order documents by supplying a known email address.

An authentication bypass vulnerability (CVE-2026-104803) in the WPCOM Member WordPress plugin allows unauthenticated attackers to hijack user sessions, including administrative accounts, by exploiting insufficient nonce and session validation in the social-login callback handler.

The WP Meteor Website Speed Optimization Addon for WordPress versions 3.4.18 and earlier contains a Stored XSS vulnerability allowing unauthenticated attackers to inject malicious scripts via the comment author name field.

An authentication bypass vulnerability in the Advanced IP Blocker WordPress plugin enables unauthenticated attackers to brute-force MFA tokens and achieve complete site takeover via reusable nonces and lack of rate limiting.

Vikunja versions 2.2.0 through 2.6.0 contain a CORS misconfiguration that implicitly trusts all localhost ports, allowing local attackers to retrieve valid bearer tokens via credentialed cross-origin requests.

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the Popup Builder's save_popup_content AJAX action.

IBM Guardium Data Protection 12.2.2 is susceptible to an unauthenticated remote denial-of-service attack via malformed gRPC task data that causes the edge-controller process to crash.

JHipster-generated reactive applications are vulnerable to SQL injection via the 'sort' parameter in paginated endpoints, allowing authenticated attackers to execute arbitrary SQL commands.

IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 contain a reflected cross-site scripting (XSS) vulnerability allowing unauthenticated remote attackers to execute arbitrary JavaScript in the Web UI.

An authenticated user can exploit improper path validation in the Backstage plugin-scaffolder-backend-module-confluence-to-markdown (CVE-2026-106560) to write files outside the designated task workspace.

An authenticated internal user can exploit improper input validation in the Backstage Sentry scaffolder module to trigger SSRF and disclose sensitive integration credentials.

D-Tale versions 3.15.1 and earlier are vulnerable to unauthenticated remote code execution due to a hardcoded Flask secret key and unsafe pandas query evaluation.

The @quasar/app-vite package (<= 3.2.0) is vulnerable to attribute injection in SSR and SSG renderer paths where unsanitized nonce values can be used to inject arbitrary HTML attributes.

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

SourceCodester Simple Student Information System version 1.0 is vulnerable to remote SQL injection in the searchquery.php file, allowing unauthenticated attackers to manipulate database queries.

The UNION HospitalManagementSystem is vulnerable to remote SQL injection via the patient_id parameter in patient_info.php, allowing unauthenticated attackers to manipulate database queries.

A vulnerability in the Zabbix Frontend allows a remote, authenticated attacker to execute arbitrary scripts in a user's browser via a Cross-Site Scripting (XSS) attack.

IBM Business Process Manager contains multiple cross-site scripting vulnerabilities that allow an unauthenticated remote attacker to inject malicious scripts into user sessions.

An unauthenticated server-side request forgery (SSRF) vulnerability in feelcrm-os 1.0.0 allows remote attackers to force the server to perform unauthorized HTTP requests by manipulating the url parameter.

The Totolink A3002MU router (v1.0.0-B20230403.1455) contains a critical authentication bypass vulnerability in the /bin/boa web server component, allowing remote unauthenticated access.

A server-side request forgery vulnerability in ChatGPTNextWeb NextChat up to version 2.16.1 allows remote attackers to manipulate the x-base-url header to perform unauthorized requests from the application server.

The Drug Recommendation System 1.0 contains a SQL injection vulnerability in the 'cmdschool' parameter of the student registration module, allowing unauthenticated remote attackers to execute arbitrary database queries.

CVE-2026-105172 is a remote SQL injection vulnerability in itsourcecode Online Admission System 1.0, reachable via the User parameter in /login1.php, for which public exploit code is available.

mooSocial versions up to 3.2.4 are vulnerable to remote SQL injection via the rating argument in the /stores/all-products endpoint, with public exploit code currently available.

The WP Mail Catcher plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via inadequate sanitization of PHPMailer error messages, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative sessions.

Beaver Builder Page Builder for WordPress (<= 2.11.0.5) is vulnerable to unauthenticated arbitrary shortcode execution via improper input validation in the Sidebar module.

The Strong Testimonials WordPress plugin (up to version 3.3.11) is vulnerable to stored Cross-Site Scripting (XSS) via the 'platform_user_photo' custom field, allowing unauthenticated attackers to execute malicious scripts in victims' browsers.

An unauthenticated stored XSS vulnerability in The Transliterator plugin (<= 2.5.8) allows attackers to inject malicious JavaScript into WordPress comments, leading to arbitrary code execution in the context of site viewers.

A stored XSS vulnerability in SEOPress versions up to 10.2 allows unauthenticated attackers to execute arbitrary scripts by injecting malicious code into the Author Display Name field.

An unauthenticated Stored Cross-Site Scripting vulnerability in the GD Rating System plugin for WordPress allows attackers to execute arbitrary JavaScript via the gdrts_live_handler AJAX action by bypassing a trivially accessible nonce.

The @a2ui/web_core package (CVE-2026-10032) contains a critical cross-site scripting (XSS) vulnerability in the openUrl function, allowing arbitrary JavaScript execution via agent-supplied javascript: URIs.

Formwork prior to version 2.3.13 contains a path traversal vulnerability in the BackupController component allowing authenticated users to read or delete arbitrary files via base64-encoded payloads.

CVE-2025-22131 is a stored cross-site scripting vulnerability in PHPOffice PhpSpreadsheet caused by improper sanitization of XLSX sheet names in navigation HTML, allowing for session cookie theft.

An authenticated user can configure malicious webhook endpoints in Trigger.dev (< 4.5.2) to perform server-side request forgery (SSRF) against internal services and cloud metadata endpoints.

An SQL injection vulnerability (CVE-2026-85215) in GG Soft Software Services Inc. Paperwork allows unauthenticated attackers to execute arbitrary SQL commands, risking unauthorized data access and modification.

An authentication bypass vulnerability in the YesWiki triples delete API allows authenticated users to delete arbitrary semantic triples, potentially resulting in site-wide denial of service.

The GSpeech TTS plugin for WordPress (<= 3.22.0) is vulnerable to Stored Cross-Site Scripting via improper input sanitization and output-buffer manipulation, allowing unauthenticated attackers to execute arbitrary JavaScript.

The Relevanssi plugin for WordPress is vulnerable to stored Cross-Site Scripting (XSS) due to insufficient input sanitization of comment content, allowing unauthenticated attackers to execute arbitrary scripts.

The Mang Board plugin for WordPress (<= 2.4.2) is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'data_type' parameter, allowing attackers to inject malicious scripts that execute in the context of user browsers.

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts in the browsers of site visitors.

The Kubio AI Page Builder plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the 'comment' parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of victim browsers.

The Ninja Forms WordPress plugin versions 3.15.4 and earlier contain a stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject malicious scripts via Paragraph Text fields with Rich Text Editor enabled.

The Visitors Traffic Real Time Statistics Pro WordPress plugin contains an unauthenticated stored XSS vulnerability allowing remote attackers to execute arbitrary JavaScript in the context of an administrator's browser.

A server-side request forgery (SSRF) vulnerability in the Fetch Tool component of the Model Context Protocol server packages allows remote attackers to perform unauthorized requests.

Food-Ordering 1.0 contains a Local File Inclusion (LFI) vulnerability in update_category.php allowing authenticated users to upload and execute arbitrary files via the update_image parameter.

A vulnerability in Ghost versions 5.2.0 through 6.61.9 allows unauthenticated remote attackers to manipulate Stripe Checkout flows to modify member records and inject malicious content into newsletters.

The Appointment Hour Booking plugin for WordPress is vulnerable to Stored DOM-based XSS via the Schedule Calendar List Renderer due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via billing fields, allowing unauthenticated attackers to execute arbitrary scripts in administrative sessions.

A stored cross-site scripting (XSS) vulnerability in the CommonsMetadata component, tracked as CVE-2026-103584, allows attackers to inject 'javascript:' URIs into image metadata, leading to unauthorized script execution in the wiki origin.

DeepWiki-Open through commit d92819a is vulnerable to an unauthenticated arbitrary file read via the repo_url parameter in the GET /codemap/file endpoint.

A stored XSS vulnerability in the PageForms extension allows attackers with page-edit permissions to inject malicious javascript: URIs via the redirect parameter.

An improper neutralization vulnerability (CVE-2026-82307) in Dolusoft SOPLOG prior to version 2026.9.4.1 allows unauthenticated attackers to execute arbitrary SQL commands against the backend database.

A SQL injection vulnerability in the QueryGenerator.doMultiFieldsOrder function of mahonelau kykms allows remote attackers to execute arbitrary database queries via the column argument.

Rebuild versions up to 4.4.7 and 4.5.0-beta5 are vulnerable to an improper authentication flaw in the login component that permits remote attackers to bypass authentication via manipulated requests.

An authenticated deserialization vulnerability in ConvertPlus <= 3.6.3 allows subscribers to inject arbitrary PHP objects via the cp_display_preview_modal AJAX action.

The heym expression engine before version 0.0.91 is vulnerable to a sandbox escape via the DotList map/filter and fallback resolver, allowing authenticated users to achieve arbitrary Python code execution.

AzuraCast versions prior to 0.23.8 are vulnerable to a DQL injection flaw in the sortOrder API parameter, allowing attackers to exfiltrate sensitive database contents.

Budibase Server versions prior to 3.45.0 allow authenticated BUILDER role users to achieve arbitrary file write and remote code execution by uploading malicious ZIP archives to the PWA icon upload endpoint.

An unauthenticated stored cross-site scripting vulnerability in the Grav Data Manager plugin allows attackers to execute malicious JavaScript in the context of an administrator's session.

SiYuan versions prior to v3.8.4 are vulnerable to a path traversal attack via the exportBrowserHTML endpoint, allowing authenticated administrators to overwrite arbitrary index.html files.

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion where authenticated users can plant symlinks to trigger recursive deletion by a root-privileged cron task, leading to potential data destruction.

MediaFlow Proxy versions 2.4.9 and earlier are vulnerable to server-side request forgery (SSRF) via the /proxy route, allowing unauthorized access to internal resources and cloud metadata services.

An unauthenticated remote SQL injection vulnerability in the CloudClassroom-PHP-Project loginlinkfaculty.php script allows attackers to manipulate authentication parameters to compromise database integrity.

A vulnerability in the CirrusSearch extension for MediaWiki allows remote, unauthenticated attackers to execute cross-site scripting (XSS) attacks through improper input sanitization.

Themify Builder versions 7.8.1 and earlier are vulnerable to Stored Cross-Site Scripting (XSS) via the css[fonts] parameter, allowing unauthenticated attackers to inject malicious scripts due to exposed nonces.

An unauthenticated stored cross-site scripting vulnerability in the Fancy Product Designer WordPress plugin allows attackers to inject malicious scripts via the output_format parameter.

A server-side request forgery (SSRF) vulnerability in the songxinjianqwe Chat server allows remote attackers to perform unauthorized requests by manipulating internal component functionality.

Snipe-IT contains a stored XSS vulnerability in the uploaded-files API due to the failure to apply safe-inline allowlists to XML documents, allowing authenticated attackers to execute arbitrary JavaScript in the victim's session context via CVE-2026-63498.

The Cline Hub dashboard fails to validate Origin headers and bypasses authorization when no secret is configured, allowing malicious websites to hijack local WebSocket connections to execute arbitrary code.

The social-auth-core library fails to verify signatures in the vk-app backend when the auth_key parameter is missing, allowing attackers to impersonate arbitrary VK users.

SunEditor versions up to 2.47.10 contain a critical XSS vulnerability (CVE-2026-59167) where insufficient sanitization of namespaced HTML tags allows for arbitrary JavaScript execution via event-handler attributes.

DBHub 0.21.2 fails to securely validate hostnames in its HTTP transport mode, allowing attackers to use DNS rebinding to execute arbitrary SQL queries via a victim's browser.

The eesy_ID2WP WordPress plugin contains a path traversal vulnerability (CVE-2026-77193) via the id2wp_path parameter, allowing unauthenticated attackers to read arbitrary files from the hosting server.

An unauthenticated remote SQL injection vulnerability in pmTicket Project-Management-Software allows attackers to execute arbitrary SQL commands via the 'conn_settings' parameter in /ajax/add_project.php.

DataLife Engine 18.0 contains a remote SQL injection vulnerability in the search module's strip_data function, allowing unauthorized database queries via the story argument.

The Formie plugin for Craft CMS is vulnerable to an unauthenticated submission hijacking flaw (CVE-2026-76087) where attackers can overwrite other users' in-progress forms by supplying arbitrary submission IDs.

Authenticated users can achieve arbitrary code execution in OpenC3 COSMOS by writing malicious payloads into user-writable configuration overlays that are subsequently rendered as code by the application.

A critical vulnerability (CVE-2026-94545) in the Next.js ImageResponse feature allows unauthenticated remote code execution when attacker-controlled input is improperly sanitized during SVG generation.

Photoview versions through 2.4.0 contain an authorization bypass in the shareAlbum GraphQL mutation, allowing authenticated users to generate unauthorized share tokens for albums owned by others.

Multiple authorization vulnerabilities, including a missing 'await' on a permission check, allow authenticated users to perform unauthorized actions and access sensitive configuration data across projects in Unleash server versions prior to 8.0.3.

Home Assistant contains a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-91130) in the Statistics Graph card, allowing arbitrary JavaScript execution when viewing entities with malicious names.

IBM Financial Transaction Manager for RedHat OpenShift is vulnerable to an improper configuration of HTTP method-based security constraints, allowing remote unauthenticated attackers to bypass access controls.

A vulnerability (CVE-2026-95499) in php-file-manager-with-code-editor versions 3.0 and earlier allows remote attackers to perform unrestricted file uploads by manipulating the 'files' argument.

An unauthenticated-accessible Local File Inclusion vulnerability in the WP Travel Engine plugin (CVE-2026-9231) allows authenticated contributors to achieve remote code execution by including arbitrary PHP files.

CVE-2026-94504 describes a stored cross-site scripting vulnerability in Ninja Forms version 3.15.3, allowing attackers to execute arbitrary scripts in an administrator's browser session via the legacy submission editor.

WordPress is susceptible to multiple vulnerabilities that may allow unauthenticated attackers to achieve remote code execution, bypass security controls, perform cross-site scripting, or access sensitive data.

An authenticated remote attacker can exploit a vulnerability in Grafana to execute a Cross-Site Scripting (XSS) attack by injecting malicious scripts into the application.

The MCP project is vulnerable to remote path traversal exploitation via the create_file function in app/api/mcp/route.ts, allowing for unauthorized file manipulation.

NivoCart versions 2.4.0 and earlier are vulnerable to remote code execution via an arbitrary file upload flaw in the File Manager multi() endpoint.

SourceCodester Drug Recommendation System 1.0 is vulnerable to remote SQL injection via the ID argument in /Admin/edit_symptom.php, allowing unauthenticated attackers to manipulate backend database queries.

Internship Management System version 1.0 is vulnerable to unauthenticated remote SQL injection via the Password parameter in login.php, for which public exploit code is available.

SourceCodester Online Reviewer Management System 1.0 is vulnerable to remote SQL injection via the 'Course' parameter, allowing unauthenticated attackers to manipulate database queries.

The WP Recipe Maker plugin for WordPress (<= 10.8.1) is vulnerable to arbitrary shortcode execution due to recursive do_shortcode calls on user-supplied metadata fields.

The Perses project, when configured with a filesystem database, fails to validate the project parameter in list requests, enabling unauthorized directory traversal and arbitrary file read access.

An evaluation injection vulnerability in xwiki-rendering-xml allows authenticated users to achieve remote code execution by injecting script macros into HTML macro output.

Authenticated users can exploit a file upload vulnerability in ClipBucket v5 before 5.5.3-#182 to achieve remote code execution by bypassing MIME validation.

The Mapster WP Maps WordPress plugin contains an arbitrary user meta write vulnerability via the my_profile_update() function, allowing authenticated users with Subscriber-level access to overwrite arbitrary user metadata.

An improper CSRF protection flaw in django-page-cms versions up to 2.0.13 enables attackers to force authenticated editors to inject stored XSS payloads.

A stored Cross-Site Scripting (XSS) vulnerability in the Vendure Admin Dashboard allows authenticated administrators to execute arbitrary JavaScript in the context of other users viewing entity lists, leading to potential account takeover.

b2evolution CMS versions 6.7.8 through 7.2.5 are vulnerable to insecure deserialization via improper validation of serialized objects containing negative integer array keys.

SiYuan versions prior to 3.8.4 contain a cross-site scripting vulnerability in bookmark label rendering that enables remote code execution due to insecure Electron configuration.

The admin3 application through version 3.0.0 is vulnerable to path traversal, allowing authenticated attackers on Windows to overwrite arbitrary files via malicious filenames in the upload handler.

An unauthenticated arbitrary file upload vulnerability in the Paid Downloads plugin (<= 3.15) allows remote attackers to execute code by bypassing file type validation via the admin_request_handler function.

The @nuxtjs/mdc package contains an XSS vulnerability (CVE-2026-63671) due to improper sanitization of SVG xlink:href attributes and iframe data:text/html sources during markdown parsing.

Craft CMS versions 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 contain a critical vulnerability allowing authenticated users to achieve remote code execution by injecting malicious payloads into improperly validated redirect parameters.

ComfyUI versions prior to 0.30.0 are vulnerable to path traversal via unsanitized input in dataset save nodes, allowing attackers to write arbitrary files and potentially achieve code execution.

changedetection.io versions 0.60.6 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability allowing unauthenticated attackers to access internal network resources.

phpList versions prior to 3.6.17 are vulnerable to CSRF, allowing an attacker to force an authenticated administrator to delete or blacklist subscribers without authorization.

Coze Studio versions up to 0.5.1 contain an input validation vulnerability in workflow SQL customization nodes allowing authenticated attackers to bypass workspace isolation and execute unauthorized SQL queries.

Pelican Panel versions before 1.0.0-beta35 fail to enforce server-side write permissions, allowing attackers with read-only access to achieve arbitrary command execution via manipulated Livewire state updates.

SIMAC MyPHR version 1.1 contains an IDOR vulnerability allowing authenticated attackers to modify arbitrary employee records and hijack user accounts.

An authenticated arbitrary file upload vulnerability in Pluck CMS v4.7.18 allows remote attackers to achieve code execution by uploading a malicious ZIP archive via the module installation interface.

SourceCodester Inventory and Monitoring System 1.0 is vulnerable to remote SQL injection via the Username argument in index.php, allowing unauthenticated attackers to execute arbitrary database commands.

Matrimonial System 1.0 contains a remote SQL injection vulnerability in the search.php script, allowing unauthenticated attackers to manipulate search arguments to execute arbitrary database commands.

A low-privileged remote attacker can exploit a command injection vulnerability at the /index.php/ajax/parameterManage endpoint using valid credentials to gain root-level code execution.

Cotonti 1.0.0 is vulnerable to unauthenticated remote code execution via a PHP object injection flaw in the Comments plugin's 'ci' GET parameter.

WuzhiCMS versions up to 4.1.0 contain a SQL injection vulnerability in the article::getDataOfJson function, allowing remote attackers to execute arbitrary SQL commands via the title or master_table parameters.

An unauthenticated remote attacker can exploit a reflected XSS vulnerability in the Teamcenter authentication redirect flow to execute arbitrary JavaScript in the context of an authenticated user session.

A vulnerability in the Governikus AusweisApp2 software allows a remote, unauthenticated attacker to execute a Cross-Site Scripting (XSS) attack.

An authenticated Insecure Direct Object Reference (IDOR) vulnerability in FlowForms version 1.1.1 and earlier allows attackers with contributor-level access to modify arbitrary forms.

An unpatched SQL injection vulnerability in zyx0814 FilePress versions 3.0.1 and earlier allows remote attackers to manipulate the orderby or order arguments within search.php.

SourceCodester Online Faculty Clearance System 1.0 is vulnerable to remote SQL injection in /delete_requirement.php via the ID argument, allowing unauthorized database access.

Online Food Ordering System 1.0 contains a SQL injection vulnerability in /web/category-foods.php that allows remote, unauthenticated attackers to execute arbitrary database queries via the ID argument.

Flextype CMS versions through 1.0.0-alpha.3 are vulnerable to path traversal via the Entries REST API, allowing authenticated attackers to read, create, or overwrite arbitrary files on the filesystem.

An unauthenticated SQL injection vulnerability in the login component of PHPGurukul Daily Expense Tracker System 1.1 allows remote attackers to execute arbitrary database queries.

ZFile versions through 5.0.5 are vulnerable to a path traversal attack allowing unauthenticated attackers to download arbitrary files via manipulated share link query parameters.

IBM Business Automation Workflow contains a vulnerability in default programming artifacts that allows for XML External Entity (XXE) injection attacks, potentially enabling unauthorized file access or server-side request forgery.

CVE-2026-90943 is a stored cross-site scripting vulnerability in filament-comments <= 3.0.0, allowing authenticated users to inject malicious scripts into comment bodies for execution in the browsers of other users.

The itsourcecode Leave Management System version 1.0 is vulnerable to remote SQL injection via the user_email parameter in login.php, enabling potential authentication bypass or unauthorized database access.

The RegisterServlet component in Soarkey StudentManagement is vulnerable to improper privilege management, allowing remote attackers to manipulate user account levels during registration via the 'level' argument.

An unauthenticated remote SSRF vulnerability exists in the Theme Download Function of tarzan-cms 1.0.0 due to insecure handling of the httpUrl parameter.

An authorization bypass vulnerability in the Shopper framework allows authenticated users with limited privileges to perform unauthorized product deletions across any collection in the database.

MoguBlog versions through 6.2 are vulnerable to unauthenticated XML External Entity (XXE) injection via the WeChat callback handler, allowing arbitrary file read and outbound SSRF.

An unauthenticated authorization bypass vulnerability in Dolibarr allows remote attackers to access arbitrary sensitive files via the document storage endpoints.

A Universal Cross-Site Scripting (UXSS) vulnerability, CVE-2026-78997, allows attackers to bypass the Same-Origin Policy in UC Browser for Android by exploiting a flaw in the ucapi login callback mechanism.

IBM webMethods Integration Server 11.1 is vulnerable to an XML External Entity (XXE) injection flaw that allows unauthenticated attackers to exfiltrate sensitive files or trigger denial of service via memory exhaustion.

FileRun versions prior to 2026.3.0 contain an OS command injection vulnerability via an improper redefinition of escapeshellcmd() that allows unauthenticated or authenticated users to execute arbitrary commands.

An insecure sandbox configuration in the Open WebUI terminal port preview feature allows authenticated users to execute arbitrary JavaScript in the application's origin, leading to session token theft and account takeover.

An unauthenticated credential access vulnerability in n8n allows users to bypass domain restrictions in the OpenAI Chat Model node via the model-search endpoint, leading to unauthorized credential exposure.

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization of the sbm_description parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

An authentication bypass vulnerability in the AJAX backend of Rizwan17 inventory-management-system allows remote attackers to execute unauthorized category additions via the userid parameter.

A stored cross-site scripting (XSS) vulnerability in the PAN-OS web interface allows an authenticated administrator to execute arbitrary JavaScript within the context of the management interface.

Chainlit versions 2.12.0 and earlier are vulnerable to an unauthenticated path traversal attack via the socket.io sessionId parameter, enabling arbitrary directory deletion.

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored XSS due to improper sanitization of multi-input sub-fields, allowing unauthenticated attackers to execute arbitrary JavaScript.

Snipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.

A missing authorization vulnerability in the iWebShop Update::index function allows unauthenticated remote attackers to access restricted administrative functions in versions up to 5.15.

The knowns application before version 0.30.0 exposes an unauthenticated management API on all network interfaces, allowing attackers to provision unauthorized tunnels via the /api/tunnel/start endpoint.

Lara Dashboard versions prior to 1.3.2 are vulnerable to arbitrary file upload via the core-upgrades endpoint, allowing unauthorized administrators to achieve remote code execution.

An authentication bypass vulnerability in SourceCodester Simple Traffic Offense System 1.0 allows remote, unauthenticated attackers to manipulate user creation via the saveuser.php script.

A SQL injection vulnerability in the login component of inventory-management-system 1.0.0 allows remote attackers to execute arbitrary database queries via the username and password parameters.

SourceCodester Online Voting System 1.0 is vulnerable to remote SQL injection via the 'id' parameter in the '/ajax.php?action=save_user' endpoint, enabling unauthenticated attackers to manipulate database queries.

The Contact Form by Supsystic WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting due to insufficient sanitization of X-Forwarded-For headers.

The Abandoned Cart Pro for WooCommerce plugin is vulnerable to privilege escalation allowing authenticated subscribers to hijack administrative accounts by intercepting SMTP settings and email recovery tokens.

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to stored cross-site scripting via insufficient input sanitization in the comment content aria-label placeholder, allowing attackers to execute arbitrary scripts in the browsers of site visitors.

The iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent plugin for WordPress contains a stored XSS vulnerability in versions 3.13.4 and earlier, allowing unauthenticated attackers to inject malicious scripts when the Secondary parser engine is enabled.

An authenticated Server-Side Request Forgery (SSRF) vulnerability in the Librarian PDF save endpoint allows attackers to perform unauthorized requests against internal network resources.

Jina AI reader is vulnerable to Server-Side Request Forgery (SSRF) due to improper URL validation during HTTP redirects, allowing access to internal network or cloud metadata services.

An unauthenticated server-side request forgery (SSRF) vulnerability in ms-swift version 4.5.2 allows attackers to perform unauthorized requests to internal network services and cloud metadata endpoints.

GastroMenum Web Panel versions prior to 31.08.2026 contain an observable response discrepancy vulnerability enabling unauthorized account footprinting and user reconnaissance.

Vehicle Management System version 1.0 contains an SQL injection vulnerability in the busid parameter of /busprofile.php, allowing unauthenticated remote attackers to execute arbitrary SQL queries.