product: SureCart

vendor: SureCart

summary: Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.

title: Surecart security vulnerability


default_status: unaffected

product: Download Monitor

vendor: WP Chill

status: unaffected

status: affected

version_type: custom

ecosystem: software/application

metric_type: Secondary

severity: medium

quality: metadata-backed

recipe_kind: composed

status: Deferred

summary: Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.


product: JupiterX Core

vendor: artbees

severity: high

summary: Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.


summary: Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.


product: WP Maps

vendor: Flipper Code – WordPress Development Company

ecosystem: php/wordpress

severity: critical

summary: Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.


product: Simply Schedule Appointments

vendor: NSquared

summary: Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.


product: Product Filter by WBW

vendor: WBW Plugins

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.

title: Wbw Plugins Product Filter By Wbw security vulnerability


summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.27.

title: Nsquared Simply Schedule Appointments security vulnerability


product: YayMail

vendor: YayCommerce

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.This issue affects YayMail: from n/a through <= 4.3.3.

title: Yaycommerce Yaymail security vulnerability


product: FOX

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5.

title: Realmag777 Fox security vulnerability


vendor: Yeeaddons

summary: Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.


vendor: Wombat Plugins

summary: Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.


product: themesflat-addons-for-elementor

vendor: Themesflat

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.2.

title: Themesflat Themesflat-Addons-For-Elementor security vulnerability


summary: Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.

title: Realmag777 Fox security vulnerability


product: Form Maker by 10Web

summary: Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.


product: Easy Digital Downloads

vendor: Awesomemotive

summary: Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.


product: InstaWP Connect

vendor: InstaWP

summary: Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.

title: Instawp Instawp Connect security vulnerability


product: Seriously Simple Podcasting

vendor: Craig Hewitt

summary: Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.

title: Craig Hewitt Seriously Simple Podcasting security vulnerability


product: AI Engine (Pro)

vendor: Jordy Meow

summary: Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine (Pro): from n/a through < 3.4.2.

title: Jordy Meow Ai Engine (Pro) security vulnerability


product: Social Slider Feed

vendor: Themeisle

summary: Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.


vendor: Josh Kohlbach

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows DOM-Based XSS.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.1.

title: Josh Kohlbach Advanced Coupons For Woocommerce Coupons security vulnerability


product: Directorist

vendor: wpWax

summary: Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.

title: Wpwax Directorist security vulnerability


product: WP Photo Album Plus

vendor: Jacob N. Breetvelt

summary: Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.


product: GeoDirectory

vendor: Paolo

summary: Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.


product: Easy Appointments

vendor: Easy Appointments

summary: Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.


product: Paid Member Subscriptions

vendor: Cozmoslabs

summary: Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.


product: Motors

vendor: StylemixThemes

summary: Subscriber Broken Access Control in Motors < 1.4.107 versions.


product: Nexter Blocks

vendor: POSIMYTH

summary: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.7.0.

title: Posimyth Nexter Blocks security vulnerability


product: Blog Filter

vendor: A WP Life

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.6.

title: A Wp Life Blog Filter security vulnerability


product: EventPrime

vendor: EventPrime

summary: Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.


product: GeekyBot

vendor: Ahmad

summary: Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.


product: weDocs

vendor: weDevs

summary: Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through <= 2.1.18.

title: Wedevs Wedocs security vulnerability


product: Nelio Content

vendor: Nelio Software

archetype: ssrf

summary: Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Request Forgery.This issue affects Nelio Content: from n/a through <= 4.3.1.

title: Nelio Software Nelio Content security vulnerability


product: Solene

vendor: Elated-Themes

summary: Unauthenticated Local File Inclusion in Solene <= 3.4 versions.


product: Solene Core

summary: Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.


product: Masteriyo - LMS

vendor: ThemeGrill

summary: Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.


product: Booking Activities

vendor: Booking Activities Team

summary: Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.


product: WpStream

vendor: wpstream

summary: Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through < 4.11.2.

title: Wpstream security vulnerability


vendor: sc Internet Vivoo

summary: Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.


product: WP Delicious

vendor: WP Delicious

summary: Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.5.

title: Wp Delicious security vulnerability


product: Elementra

vendor: ThemeREX Group

summary: Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.


product: SpeakOut! Email Petitions

vendor: SpeakOut!

summary: Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.


product: WP Directory Kit

vendor: Wp Directory Kit

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.

title: Wp Directory Kit security vulnerability


product: Events Calendar for GeoDirectory

vendor: Stiofan

summary: Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.


product: AWP Classifieds

vendor: WPTasty

summary: Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.


summary: Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.


product: Display Eventbrite Events

vendor: fullworks

summary: Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: from n/a through <= 6.5.6.

title: Fullworks Display Eventbrite Events security vulnerability


product: RSVP and Event Management

vendor: WP Chill

summary: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.

title: Wp Chill Rsvp And Event Management security vulnerability


product: Mikado Core

vendor: Mikado-Themes

summary: Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.


summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Core: from n/a through <= 1.6.

title: Mikado-Themes Mikado Core security vulnerability


product: Alloggio - Hotel Booking

vendor: Edge-Themes

summary: Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.


product: Shipment Tracker for Woocommerce

vendor: Amit Mittal

summary: Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.


product: Hydra Booking

vendor: Themefic

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.38.

title: Themefic Hydra Booking security vulnerability


product: Doofinder for WooCommerce

vendor: Doofinder

summary: Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through <= 2.10.13.

title: Doofinder Doofinder For Woocommerce security vulnerability


product: Tourfic

summary: Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4.

title: Themefic Tourfic security vulnerability


product: LabtechCO

vendor: themeStek

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows PHP Local File Inclusion.This issue affects LabtechCO: from n/a through <= 8.3.

title: Themestek Labtechco security vulnerability


product: Zermatt

vendor: Select-Themes

summary: Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.


product: MultiLoca

vendor: Techspawn

summary: Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.


product: Getaway

summary: Unauthenticated Local File Inclusion in Getaway < 1.8 versions.


product: MagOne

vendor: Sneeit

summary: Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.


product: Aperitif

vendor: Elated-Themes

summary: Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.


summary: Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6.


product: Töbel

summary: Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.


product: Blueprint

vendor: Code Supply Co.

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.


product: WaveRide

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.

title: Select-Themes Waveride security vulnerability


product: Fidalgo

summary: Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.


product: Askka

summary: Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.


product: Konsept

summary: Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.


product: NeoBeat

summary: Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.


product: Malmö

summary: Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.


product: Uppercase

vendor: codesupplyco

summary: Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.


product: Hiroshi

summary: Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.


summary: Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.7.

title: Wp Chill Revive.So security vulnerability


product: Client Invoicing by Sprout Invoices

vendor: BoldGrid

summary: Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.

title: Boldgrid Client Invoicing By Sprout Invoices security vulnerability


product: Share This Image

vendor: ILLID

summary: Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through <= 2.12.

title: Illid Share This Image security vulnerability


product: Sunshine Photo Cart

vendor: sunshinephotocart

summary: Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive Data.This issue affects Sunshine Photo Cart: from n/a through < 3.6.2.

title: Sunshinephotocart Sunshine Photo Cart security vulnerability


product: WpTravelly

vendor: magepeopleteam

summary: Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.

title: Magepeopleteam Wptravelly security vulnerability


product: DirectoryPress

vendor: Designinvento

summary: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedded Sensitive Data.This issue affects DirectoryPress: from n/a through <= 3.6.26.

title: Designinvento Directorypress security vulnerability


product: Santé

summary: Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.


product: Mr. SEO

summary: Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.


product: 12 Step Meeting List

vendor: AA Web Servant

summary: Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.19.9.

title: Aa Web Servant 12 Step Meeting List security vulnerability


summary: Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.19.9.


product: Instantio

summary: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Data.This issue affects Instantio: from n/a through <= 3.3.30.

title: Themefic Instantio security vulnerability


summary: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Retrieve Embedded Sensitive Data.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through < 5.6.5.

title: Magepeopleteam Bus Ticket Booking With Seat Reservation security vulnerability


product: Mildhill

summary: Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.


product: InPost Gallery

summary: Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.


product: Custom Query Blocks

vendor: Ronald Huereca

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.5.0.

title: Ronald Huereca Custom Query Blocks security vulnerability


product: SingleMalt

summary: Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.


product: Playroom

summary: Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.


product: Valiance

summary: Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.


product: B Blocks

vendor: bPlugins

summary: Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.


product: Micdrop

summary: Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.


summary: Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.


product: Hitek

vendor: xtemos

summary: Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.


product: Datalogics Ecommerce Delivery

vendor: Datalogics

summary: Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.


product: RepairBuddy

vendor: Webful Creations

summary: Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.


product: Booktics

vendor: Arraytics

summary: Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.


vendor: Ateeq Rafeeq

summary: Insertion of Sensitive Information Into Sent Data vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through <= 4.1132.

title: Ateeq Rafeeq Repairbuddy security vulnerability


product: WP BASE Booking

vendor: Hakan Ozevin

summary: Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.


product: NM Gift Registry and Wishlist Lite

vendor: nmerii

summary: Missing Authorization vulnerability in nmerii NM Gift Registry and Wishlist Lite nm-gift-registry-and-wishlist-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NM Gift Registry and Wishlist Lite: from n/a through <= 5.13.

title: Nmerii Nm Gift Registry And Wishlist Lite security vulnerability


product: Webenvo

vendor: A WP Life

summary: Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.


product: Atomlab

vendor: ThemeMove

summary: Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.


product: WP-BusinessDirectory

vendor: CMSJunkie – WordPress Business Directory Plugins

summary: Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.


product: DEPART

vendor: Andy Ha

summary: Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through <= 1.0.7.

title: Andy Ha Depart security vulnerability


product: HAPPY

vendor: VillaTheme

summary: Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.10.


product: Ultra Addons for WPForms

vendor: Themefic

summary: Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.


product: W3 Total Cache

vendor: BoldGrid

summary: Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.


product: Blocksy Companion Pro

vendor: Creative Themes

summary: Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.


product: WPZOOM Addons for Elementor

vendor: WPZOOM

summary: Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.


product: Academy LMS Pro

vendor: Kodezen LLC

summary: Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2.


product: Order Tracking

vendor: Rustaurius

summary: Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3.

title: Rustaurius Order Tracking security vulnerability


product: Grand Photography

vendor: ThemeGoods

summary: Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.

title: Themegoods Grand Photography security vulnerability


product: MyBookTable Bookstore

vendor: zookatron

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable allows Stored XSS.This issue affects MyBookTable Bookstore: from n/a through <= 3.6.0.

title: Zookatron Mybooktable Bookstore security vulnerability


product: Super Custom Login

vendor: Obadiah

summary: Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Custom Login: from n/a through <= 1.1.

title: Obadiah Super Custom Login security vulnerability


product: BizReview

vendor: Foysal Imran

summary: Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizReview: from n/a through <= 1.5.13.

title: Foysal Imran Bizreview security vulnerability


product: Filter Plus

vendor: Wpbens

summary: Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter Plus: from n/a through <= 1.1.17.

title: Wpbens Filter Plus security vulnerability


product: iPOSpays Gateways WC

vendor: iPOSPays

summary: Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through <= 1.3.7.

title: Ipospays Ipospays Gateways Wc security vulnerability


product: Wava Payment

summary: Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wava Payment: from n/a through <= 0.3.7.

title: Wava.Co Wava Payment security vulnerability


product: WpXmas-Snow

vendor: Pankaj Kumar

summary: Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpXmas-Snow: from n/a through <= 1.1.

title: Pankaj Kumar Wpxmas-Snow security vulnerability


product: KuteShop

vendor: kutethemes

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes KuteShop kuteshop allows PHP Local File Inclusion.This issue affects KuteShop: from n/a through <= 4.2.9.

title: Kutethemes Kuteshop security vulnerability


summary: Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KuteShop: from n/a through <= 4.2.9.


product: Boutique

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allows PHP Local File Inclusion.This issue affects Boutique: from n/a through <= 2.3.3.

title: Kutethemes Boutique security vulnerability


product: JW Player for WordPress

vendor: ilGhera

summary: Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a through <= 2.3.6.

title: Ilghera Jw Player For Wordpress security vulnerability


product: Download Manager

vendor: Shahjada

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53.

title: Shahjada Download Manager security vulnerability


product: Download Attachments

vendor: dFactory

summary: Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.4.0.

title: Dfactory Download Attachments security vulnerability


product: Bluestreet

vendor: priyanshumittal

summary: Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from n/a through <= 1.7.3.

title: Priyanshumittal Bluestreet security vulnerability


product: NewsExo

vendor: themearile

summary: Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <= 7.1.

title: Themearile Newsexo security vulnerability


product: Busiprof

summary: Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: from n/a through <= 2.5.2.

title: Priyanshumittal Busiprof security vulnerability


product: Appointment

summary: Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through <= 3.5.5.

title: Priyanshumittal Appointment security vulnerability


product: SpicePress

vendor: spicethemes

summary: Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.

title: Spicethemes Spicepress security vulnerability


product: Education Base

vendor: acmethemes

summary: Missing Authorization vulnerability in acmethemes Education Base education-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Base: from n/a through <= 3.0.8.

title: Acmethemes Education Base security vulnerability


product: Biolife

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP Local File Inclusion.This issue affects Biolife: from n/a through <= 3.2.3.

title: Kutethemes Biolife security vulnerability


summary: Missing Authorization vulnerability in kutethemes Biolife biolife allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Biolife: from n/a through <= 3.2.3.


product: TechOne

summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affects TechOne: from n/a through <= 3.0.3.

title: Kutethemes Techone security vulnerability


product: Armania

summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affects Armania: from n/a through <= 1.4.8.

title: Kutethemes Armania security vulnerability


product: Ashe

vendor: wproyal

summary: Missing Authorization vulnerability in wproyal Ashe ashe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe: from n/a through <= 2.266.

title: Wproyal Ashe security vulnerability


product: DukaMarket

summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issue affects DukaMarket: from n/a through <= 1.3.0.

title: Kutethemes Dukamarket security vulnerability


product: Uminex

summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affects Uminex: from n/a through <= 1.0.9.

title: Kutethemes Uminex security vulnerability


product: Getty Images

vendor: Getty Images

summary: Server-Side Request Forgery (SSRF) vulnerability in Getty Images Getty Images getty-images allows Server Side Request Forgery.This issue affects Getty Images: from n/a through <= 4.1.0.

title: Getty Images security vulnerability


product: WPSchoolPress

summary: Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through <= 2.2.35.

title: Ronik@Unlimitedwp Wpschoolpress security vulnerability


product: Grand Blog

vendor: ThemeGoods

summary: Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.

title: Themegoods Grand Blog security vulnerability


product: Grand Car Rental

summary: Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through <= 3.6.9.

title: Themegoods Grand Car Rental security vulnerability


product: Grand Portfolio

summary: Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.

title: Themegoods Grand Portfolio security vulnerability


product: Grand Magazine

summary: Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.

title: Themegoods Grand Magazine security vulnerability


product: Livemesh Addons for Elementor

vendor: livemesh

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through <= 9.0.

title: Livemesh Livemesh Addons For Elementor security vulnerability


product: Mogi

vendor: SpabRice

summary: Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.

title: Spabrice Mogi security vulnerability


product: Qubely

vendor: Themeum

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14.

title: Themeum Qubely security vulnerability


product: RPS Include Content

vendor: redpixelstudios

summary: Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RPS Include Content: from n/a through <= 1.2.2.

title: Redpixelstudios Rps Include Content security vulnerability


product: Theme Editor

summary: Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.

title: Mndpsingh287 Theme Editor security vulnerability


product: Blackfyre

vendor: Skywarrior

summary: Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a through <= 2.5.4.

title: Skywarrior Blackfyre security vulnerability


product: Nyla

summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: from n/a through 1.7.


product: Payment Plugins for PayPal WooCommerce

vendor: Payment Plugins

summary: Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.

title: Payment Plugins Payment Plugins For Paypal Woocommerce security vulnerability


product: Wp Ultimate Review

vendor: Roxnor

summary: Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.

title: Roxnor Wp Ultimate Review security vulnerability


product: GlobalPayments WooCommerce

vendor: Global Payments

summary: Server-Side Request Forgery (SSRF) vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.18.0.

title: Global Payments Globalpayments Woocommerce security vulnerability


product: Leaflet Map

vendor: bozdoz

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bozdoz Leaflet Map leaflet-map allows Stored XSS.This issue affects Leaflet Map: from n/a through <= 3.4.4.

title: Bozdoz Leaflet Map security vulnerability


vendor: sonaar

summary: Server-Side Request Forgery (SSRF) vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Server Side Request Forgery.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.11.

title: Sonaar Mp3 Audio Player For Music, Radio & Podcast By Sonaar security vulnerability


product: Cream Blog

vendor: themebeez

summary: Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.

title: Themebeez Cream Blog security vulnerability


product: Royale News

summary: Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royale News: from n/a through <= 2.2.4.

title: Themebeez Royale News security vulnerability


product: UnitechPay

vendor: Unitech Web

summary: Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through <= 1.0.2.

title: Unitech Web Unitechpay security vulnerability


product: Total Poll Lite

vendor: TotalSuite

summary: Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through <= 4.12.0.

title: Totalsuite Total Poll Lite security vulnerability


product: iGMS Direct Booking

vendor: igms

summary: Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iGMS Direct Booking: from n/a through <= 1.3.

title: Igms Igms Direct Booking security vulnerability


product: Video Conferencing with Zoom

vendor: Deepen Bajracharya

summary: Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Conferencing with Zoom: from n/a through <= 4.6.6.

title: Deepen Bajracharya Video Conferencing With Zoom security vulnerability


product: WP Simple HTML Sitemap

vendor: Ashish Ajani

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.

title: Ashish Ajani Wp Simple Html Sitemap security vulnerability


product: Mayosis Core

vendor: TeconceTheme

summary: Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mayosis Core: from n/a through 5.4.7.


product: Razorpay for WooCommerce

vendor: Razorpay

summary: Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.

title: Razorpay Razorpay For Woocommerce security vulnerability


product: leadlovers forms

vendor: leadlovers

summary: Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through <= 1.0.2.

title: Leadlovers Leadlovers Forms security vulnerability


product: Panda Pods Repeater Field

vendor: Coding Panda

summary: Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through <= 1.5.12.

title: Coding Panda Panda Pods Repeater Field security vulnerability


product: SW Core

vendor: Magentech

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local File Inclusion. This issue affects SW Core: from n/a through 1.7.18.

title: Magentech Sw Core security vulnerability


vendor: ProWCPlugins

summary: Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Price by Formula for WooCommerce: from n/a through <= 2.5.6.

title: Prowcplugins Product Price By Formula For Woocommerce security vulnerability


product: TrueBooker

vendor: themetechmount

summary: Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.5.

title: Themetechmount Truebooker security vulnerability


product: Leadrebel

vendor: leadrebel

summary: Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadrebel: from n/a through <= 1.0.2.

title: Leadrebel security vulnerability


product: SEO Friendly Images

vendor: Vladimir Prelovac

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac SEO Friendly Images seo-image allows DOM-Based XSS.This issue affects SEO Friendly Images: from n/a through <= 3.0.5.

title: Vladimir Prelovac Seo Friendly Images security vulnerability


product: Hello Bar Popup Builder

vendor: telepathy

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1.

title: Telepathy Hello Bar Popup Builder security vulnerability


product: Korea SNS

vendor: Jongmyoung Kim

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jongmyoung Kim Korea SNS korea-sns allows DOM-Based XSS.This issue affects Korea SNS: from n/a through <= 1.7.0.

title: Jongmyoung Kim Korea Sns security vulnerability


product: Book Previewer for Woocommerce

summary: Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.

title: G5Theme Book Previewer For Woocommerce security vulnerability


product: NitroPack

vendor: NitroPack

summary: Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.

title: Nitropack security vulnerability


product: Visual Link Preview

vendor: Brecht

summary: Server-Side Request Forgery (SSRF) vulnerability in Brecht Visual Link Preview visual-link-preview allows Server Side Request Forgery.This issue affects Visual Link Preview: from n/a through <= 2.3.0.

title: Brecht Visual Link Preview security vulnerability


product: Extra Fees Plugin for WooCommerce

vendor: Dotstore

summary: Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery.This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.

title: Dotstore Extra Fees Plugin For Woocommerce security vulnerability


product: ShipTime: Discounted Shipping Rates

vendor: shiptime

summary: Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipTime: Discounted Shipping Rates: from n/a through <= 1.1.1.

title: Shiptime Shiptime: Discounted Shipping Rates security vulnerability


product: iZooto

vendor: shrikantkale

summary: Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iZooto: from n/a through <= 3.7.20.

title: Shrikantkale Izooto security vulnerability


product: MK Google Directions

vendor: Manoj Kumar

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manoj Kumar MK Google Directions google-distance-calculator allows DOM-Based XSS.This issue affects MK Google Directions: from n/a through <= 3.1.1.

title: Manoj Kumar Mk Google Directions security vulnerability


product: Court Reservation

vendor: webmuehle

summary: Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Court Reservation: from n/a through <= 1.10.11.

title: Webmuehle Court Reservation security vulnerability


product: Download Manager

vendor: Shahjada

summary: Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.

title: Shahjada Download Manager security vulnerability


product: Emphires

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires allows PHP Local File Inclusion.This issue affects Emphires: from n/a through <= 3.9.

title: Creatives Planet Emphires security vulnerability


product: Pinpoint Booking System

vendor: DOTonPAPER

summary: Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.6.5.

title: Dotonpaper Pinpoint Booking System security vulnerability


product: Freeio

vendor: ApusTheme

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.

title: Apustheme Freeio security vulnerability


product: Diet Calorie Calculator

vendor: MWP Development

summary: Missing Authorization vulnerability in MWP Development Diet Calorie Calculator diet-calorie-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Diet Calorie Calculator: from n/a through <= 1.1.1.

title: Mwp Development Diet Calorie Calculator security vulnerability


product: Homeo

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local File Inclusion.This issue affects Homeo: from n/a through <= 1.2.59.

title: Apustheme Homeo security vulnerability


product: linkPizza-Manager

vendor: Arjan Pronk

summary: Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5.

title: Arjan Pronk Linkpizza-Manager security vulnerability


product: Garden Gnome Package

vendor: Chief Gnome

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chief Gnome Garden Gnome Package garden-gnome-package allows DOM-Based XSS.This issue affects Garden Gnome Package: from n/a through <= 2.4.1.

title: Chief Gnome Garden Gnome Package security vulnerability


product: OrganicFood

vendor: UnTheme

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnTheme OrganicFood organicfood allows PHP Local File Inclusion.This issue affects OrganicFood: from n/a through <= 3.6.4.

title: Untheme Organicfood security vulnerability


product: The Moneytizer

vendor: lvaudore

summary: Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Moneytizer: from n/a through <= 10.0.10.

title: Lvaudore The Moneytizer security vulnerability


product: BSK PDF Manager

vendor: bannersky

summary: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.

title: Bannersky Bsk Pdf Manager security vulnerability


product: Rapid Car Check Vehicle Data

vendor: Rapid Car Check

summary: Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.

title: Rapid Car Check Rapid Car Check Vehicle Data security vulnerability


product: WP Frontend Profile

vendor: Glowlogix

summary: Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Frontend Profile: from n/a through <= 1.3.9.

title: Glowlogix Wp Frontend Profile security vulnerability


product: eShipper Commerce

vendor: eshipper

summary: Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eShipper Commerce: from n/a through <= 2.16.12.

title: Eshipper Eshipper Commerce security vulnerability


product: Author Avatars List/Block

vendor: Paul Bearne

summary: Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.

title: Paul Bearne Author Avatars List/Block security vulnerability


vendor: AdAstraCrypto

summary: Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.

title: Adastracrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations security vulnerability


product: tagDiv Composer

vendor: tagDiv

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Stored XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

title: Tagdiv Tagdiv Composer security vulnerability


product: FSM Custom Featured Image Caption

vendor: fesomia

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.

title: Fesomia Fsm Custom Featured Image Caption security vulnerability


product: Simply Schedule Appointments

vendor: NSquared

summary: Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.

title: Nsquared Simply Schedule Appointments security vulnerability


product: Podigee

vendor: podigee

summary: Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery.This issue affects Podigee: from n/a through <= 1.4.0.

title: Podigee security vulnerability


product: Elfsight WhatsApp Chat CC

vendor: Elfsight

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elfsight Elfsight WhatsApp Chat CC elfsight-whatsapp-chat allows DOM-Based XSS.This issue affects Elfsight WhatsApp Chat CC: from n/a through <= 1.2.0.

title: Elfsight Elfsight Whatsapp Chat Cc security vulnerability


product: MAIO – The new AI GEO / SEO tool

vendor: HBSS Technologies

summary: Missing Authorization vulnerability in HBSS Technologies MAIO – The new AI GEO / SEO tool maio-the-new-ai-geo-seo-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAIO – The new AI GEO / SEO tool: from n/a through <= 6.2.8.

title: Hbss Technologies Maio – The New Ai Geo / Seo Tool security vulnerability


product: The Publisher Desk ads.txt

vendor: PublisherDesk

summary: Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through <= 1.5.0.

title: Publisherdesk The Publisher Desk Ads.Txt security vulnerability


product: AI Workflow Automation

vendor: massiveshift

summary: Missing Authorization vulnerability in massiveshift AI Workflow Automation ai-workflow-automation-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Workflow Automation: from n/a through <= 1.4.2.

title: Massiveshift Ai Workflow Automation security vulnerability


product: WowOptin

vendor: WPXPO

summary: Missing Authorization vulnerability in WPXPO WowOptin optin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowOptin: from n/a through <= 1.4.32.

title: Wpxpo Wowoptin security vulnerability


product: ShopWP

vendor: Andrew

summary: Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopWP: from n/a through <= 5.2.4.

title: Andrew Shopwp security vulnerability


product: Animation Addons for Elementor

vendor: Wealcoder

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows DOM-Based XSS.This issue affects Animation Addons for Elementor: from n/a through <= 2.6.1.

title: Wealcoder Animation Addons For Elementor security vulnerability


vendor: wpbits

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.8.1.

title: Wpbits Wpbits Addons For Elementor Page Builder security vulnerability


vendor: nfusionsolutions

summary: Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.

title: Nfusionsolutions Precious Metals Automated Product Pricing – Pro security vulnerability


product: MIPL WC Multisite Sync

vendor: Mulika Team

summary: Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MIPL WC Multisite Sync: from n/a through <= 1.4.4.

title: Mulika Team Mipl Wc Multisite Sync security vulnerability


product: Make My Trivia

vendor: Netro Systems

summary: Missing Authorization vulnerability in Netro Systems Make My Trivia trivialy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Make My Trivia: from n/a through <= 1.1.0.

title: Netro Systems Make My Trivia security vulnerability


vendor: ZealousWeb

summary: Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.

title: Zealousweb Accept Paypal Payments Using Contact Form 7 security vulnerability


product: UiCore Elements

vendor: uicore

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through <= 1.3.14.

title: Uicore Uicore Elements security vulnerability


product: The Tribal

vendor: thetechtribe

summary: Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue affects The Tribal: from n/a through <= 1.3.4.

title: Thetechtribe The Tribal security vulnerability


product: RT-Theme 18 | Extensions

vendor: stmcan

summary: Cross-Site Request Forgery (CSRF) vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Cross Site Request Forgery.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

title: Stmcan Rt-Theme 18 | Extensions security vulnerability


summary: Insertion of Sensitive Information Into Sent Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Retrieve Embedded Sensitive Data.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.


vendor: tagDiv

summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This issue affects tagDiv Composer: from n/a through <= 5.4.3.


vendor: mailercloud

summary: Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.

title: Mailercloud Mailercloud – Integrate Webforms And Synchronize Website Co… security vulnerability


product: G5Plus April

summary: Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.

title: G5Theme G5Plus April security vulnerability


product: AnyTrack Affiliate Link Manager

vendor: AnyTrack

summary: Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.5.5.

title: Anytrack Anytrack Affiliate Link Manager security vulnerability


product: Flipmart

vendor: CKThemes

summary: Missing Authorization vulnerability in CKThemes Flipmart flipmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flipmart: from n/a through <= 2.8.

title: Ckthemes Flipmart security vulnerability


product: bandit

vendor: mtrudel

version_type: semver

version_type: git

metric_type: Primary

part: a

status: Analyzed

summary: Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response. Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer. The content-length path in the same function correctly enforces the limit and is not affected. This issue affects bandit: from 1.4.0 before 1.11.1.

title: Mtrudel Bandit security vulnerability


author: Codex

description: High-severity Bandit denial of service via uncapped WebSocket permessage-deflate inflation. Upgrade Hex package bandit to 1.11.0+ or disable compressed WebSocket upgrades until patched.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-39804 - Bandit permessage-deflate decompression DoS

recipe_kind: markdown-draft

summary: Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled. 'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs. An unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill. This vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled.

title: Mtrudel Bandit security vulnerability


summary: Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit allows HTTP request smuggling via duplicate Content-Length headers. 'Elixir.Bandit.Headers':get_content_length/1 in lib/bandit/headers.ex uses List.keyfind/3, which returns only the first matching header. When a request contains two Content-Length headers with different values, Bandit silently accepts it, uses the first value to read the body, and dispatches the remaining bytes as a second pipelined request on the same keep-alive connection. RFC 9112 §6.3 requires recipients to treat this as an unrecoverable framing error. When Bandit sits behind a proxy that picks the last Content-Length value and forwards the request rather than rejecting it, an unauthenticated attacker can smuggle requests past edge WAF rules, path-based ACLs, rate limiting, and audit logging. This issue affects bandit: before 1.11.0.

title: Mtrudel Bandit security vulnerability


summary: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion. 'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\r\n is followed immediately by the empty trailer line \r\n. RFC 9112 §7.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection. A handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement. This issue affects bandit: from 1.6.1 before 1.11.1.

title: Mtrudel Bandit security vulnerability


archetype: generic

summary: Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections. 'Elixir.Bandit.Pipeline':determine_scheme/2 in lib/bandit/pipeline.ex returns the client-supplied URI scheme verbatim, ignoring the transport's secure? flag. HTTP/1.1 absolute-form request targets (e.g. GET https://victim/path HTTP/1.1) and the HTTP/2 :scheme pseudo-header are both attacker-controlled strings that flow through this function. Over a plaintext TCP connection, a client can declare https and Bandit will set conn.scheme = :https even though no TLS was negotiated. Downstream Plug consumers that branch on conn.scheme are silently misled: Plug.SSL's already-secure branch skips its HTTP→HTTPS redirect, cookies emitted with secure: true are sent over plaintext, audit logs record requests as having arrived over HTTPS, and CSRF/SameSite gating may make incorrect decisions. This issue affects bandit: from 1.0.0 before 1.11.0.

title: Mtrudel Bandit security vulnerability


product: FortiSandbox

vendor: Fortinet

product: FortiSandbox PaaS

business_risk: Critical risk: an unauthenticated remote attacker may execute unauthorized code or commands through crafted HTTP requests against the affected FortiSandbox API. Impact may include compromise of confidentiality, integrity, and availability. The supplied record also identifies this CVE as present in CISA’s Known Exploited Vulnerabilities catalog, increasing remediation priority.

claim: Fortinet identifies FortiSandbox as affected by an OS command injection vulnerability in the API component.

claim: Fortinet identifies FortiSandbox 4.4.0 through 4.4.8 as affected.

claim: The vulnerability may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

kind: exposure

claim: Fortinet’s stated solution is to upgrade FortiSandbox 4.4.0 through 4.4.8 to version 4.4.9 or above.

claim: The vendor-recommended remediation is upgrading affected FortiSandbox 4.4 installations to 4.4.9 or later.

kind: remediation

claim: A safe post-remediation check is to confirm the deployed FortiSandbox version is 4.4.9 or later, matching the vendor’s stated solution threshold.

kind: verification

exposure_conditions: FortiSandbox 4.4.0 through 4.4.8 is deployed.

exposure_conditions: The affected API component is reachable by an attacker who can send crafted HTTP requests, particularly where the management/API interface is internet-exposed or otherwise reachable from an untrusted network.

exposure_conditions: FortiSandbox 5.0 and FortiSandbox PaaS 5.0 are identified by Fortinet as not affected.

recipe_specificity: specific

remediation_steps: Upgrade FortiSandbox 4.4.0 through 4.4.8 to FortiSandbox 4.4.9 or later.

remediation_steps: Prioritize remediation according to applicable CISA Known Exploited Vulnerabilities and organizational incident-response requirements.

remediation_steps: Until upgraded, restrict access to the FortiSandbox management/API interface to trusted administrative networks using existing supported access-control mechanisms; do not rely on exposure reduction as a substitute for the vendor upgrade.

remediation_steps: Review relevant authentication, API-access, and system logs for suspicious unauthenticated HTTP activity or unexpected command execution, while preserving evidence for forensic review.

status: complete

uncertainty: The NVD description contains an unresolved placeholder for the attack vector, while Fortinet describes the vector generally as crafted HTTP requests to an API endpoint.

uncertainty: The supplied source record lists CISA KEV dates of July 16, 2026 and July 19, 2026; those dates were not independently confirmed from the returned CISA source in this lookup.

uncertainty: Fortinet’s advisory states that FortiSandbox 5.0 and FortiSandbox PaaS 5.0 are not affected, but it does not provide a detailed product-version inventory or a specific API endpoint name in the returned content.

verification_steps: Confirm through the supported FortiSandbox administrative/version-information interface that the installed version is 4.4.9 or later.

verification_steps: Confirm that any FortiSandbox 4.4 deployment is not reporting version 4.4.0 through 4.4.8.

verification_steps: Validate that the management/API interface is not reachable by untrusted networks except where explicitly required, without sending exploit payloads or performing intrusive tests.

verification_steps: After upgrade, review vendor-recommended health and operational checks to confirm the appliance remains functional.

known_ransomware_campaign_use: Unknown

notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808

required_action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

vendor_project: Fortinet

vulnerability_name: Fortinet FortiSandbox OS Command Injection Vulnerability

description: CVE-2026-39808 is CISA KEV FortiSandbox leftover. NVD CPE last-affects including 4.4.9. Vendor FG-IR-26-100 names 4.4.9+. Live NVD has no PaaS CPE.

title: CVE-2026-39808: FortiSandbox API Command Injection

product: fortisandbox

vendor: fortinet

summary: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>


product: FortiClientEMS

product: forticlientems

summary: A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2.0 through 7.2.12, FortiClientEMS 7.0 all versions may allow attacker to execute unauthorized code or commands via sending crafted requests

title: Fortinet Forticlientems security vulnerability


summary: A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosure via decrypting database dump.


product: FortiWeb

product: fortiweb

summary: A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to denial of service via <insert attack vector here>

title: Fortinet Fortiweb security vulnerability


summary: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.5, FortiSandbox PaaS 4.4.0 through 4.4.8, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>

title: Fortinet Fortisandbox security vulnerability


product: FortiSandbox Cloud

status: Modified

summary: A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests.


summary: A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.12, FortiWeb 7.2.7 through 7.2.12, FortiWeb 7.0.10 through 7.0.12 may allow attacker to execute unauthorized code or commands via <insert attack vector here>


product: FortiDDoS-F

product: fortiddos-f

summary: A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7.2.2 may allow attacker to execute unauthorized code or commands via sending crafted HTTP requests

title: Fortinet Fortiddos-F security vulnerability


product: Apache NiFi

vendor: Apache Software Foundation

product: nifi

vendor: apache

summary: The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

title: Apache Nifi security vulnerability


product: cmd/go

vendor: Go toolchain

product: go

vendor: golang

summary: The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

title: Golang Go security vulnerability


summary: The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.


product: net/mail

vendor: Go standard library

default_status: affected

product: Red Hat OpenShift Container Platform 4.19

vendor: Red Hat

version_type: rpm

product: Cert Manager support for Red Hat OpenShift release 1.19

product: Logging for Red Hat OpenShift 6.4

product: Logging Subsystem for Red Hat OpenShift 6.2

product: Logging Subsystem for Red Hat OpenShift 6.5

product: OpenShift API for Data Protection 1.3

product: OpenShift API for Data Protection 1.6

product: Red Hat Advanced Cluster Security 4.9

product: Red Hat Advanced Cluster Security for Kubernetes 4.10

product: Red Hat Developer Hub 1.10

description: CVE-2026-39820 lets crafted input exhaust CPU in Go ParseAddress, ParseAddressList, and ParseDate. GHSA names no version range and no floor.

title: CVE-2026-39820: Go ParseAddress DoS, No Named Floor

summary: Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

title: Golang Go security vulnerability


product: net/http

product: Red Hat Ansible Automation Platform 2.5 for RHEL 8

product: Red Hat Ansible Automation Platform 2.5 for RHEL 9

product: Red Hat Ansible Automation Platform 2.6 for RHEL 10

product: Red Hat Ansible Automation Platform 2.6 for RHEL 9

product: Red Hat Ansible Automation Platform 2.7 for RHEL 10

product: Red Hat Ansible Automation Platform 2.7 for RHEL 9

product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 10.0 Extended Update Support

product: Red Hat Enterprise Linux 7 Extended Lifecycle Support

description: CVE-2026-39821 lets Go ToASCII/ToUnicode accept Punycode that decodes to ASCII, skipping hostname checks. GHSA names no version range and no floor.

title: CVE-2026-39821: Go IDNA Punycode, No Named Floor

product: net

summary: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".


product: os

product: go

summary: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

title: Golang Go security vulnerability


product: html/template

summary: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.


product: net/http/httputil

summary: ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.


summary: If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

title: Golang Go security vulnerability


product: crypto

summary: An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

title: Golang Crypto security vulnerability


product: Cryostat 4 on RHEL 9

product: RHEM 1.0 for RHEL 9

product: RHEM 1.1 for RHEL 10

product: RHEM 1.1 for RHEL 9

product: Cert Manager support for Red Hat OpenShift release 1.19

product: DevWorkspace Operator 0.42

product: multicluster engine for Kubernetes 2.10

product: multicluster engine for Kubernetes 2.11

product: multicluster engine for Kubernetes 2.6

product: multicluster engine for Kubernetes 2.8

product: OpenShift API for Data Protection 1.3

summary: When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

title: Golang Crypto security vulnerability


product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9

description: CVE-2026-39829 is golang.org/x/crypto/ssh DoS. GHAD names 0.52.0. Leftover dump text agrees. Do not invent 0.52.1 later.

title: CVE-2026-39829: golang.org/x/crypto/ssh pathological RSA/DSA DoS

summary: The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.


description: Critical Go SSH denial-of-service where unsolicited global responses can block the read loop and leak a stuck connection. Upgrade to 0.52.0+ and audit peer-input handling.

title: CVE-2026-39830 - Go x/crypto ssh unsolicited response deadlock

product: crypto

summary: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.


description: Critical Go SSH flaw where FIDO/U2F signature verification does not enforce the user-presence flag. Upgrade to 0.52.0+ and review security-key policy extensions.

title: CVE-2026-39831 - Go x/crypto ssh FIDO presence bypass

summary: The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

title: Golang Crypto security vulnerability


product: OpenShift API for Data Protection 1.6

product: Red Hat Advanced Cluster Security 4.9

product: Red Hat Advanced Cluster Security for Kubernetes 4.10

description: Critical Go ssh-agent flaw where forwarding a key strips constraint extensions such as destination restrictions. Upgrade to 0.52.0+ and audit forwarded-agent trust boundaries.

title: CVE-2026-39832 - Go x/crypto ssh agent forwarded constraint loss

summary: When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.


description: Critical Go ssh-agent flaw where NewKeyring accepts ConfirmBeforeUse constraints but never enforces them. Upgrade to 0.52.0+ and reject unsupported key constraints.

title: CVE-2026-39833 - Go x/crypto ssh agent confirm constraint bypass

summary: The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.


description: Critical Go SSH denial-of-service where a single channel write over 4GB can trigger an internal infinite loop. Upgrade to 0.52.0+ and audit large-buffer write paths.

title: CVE-2026-39834 - Go x/crypto ssh large channel write infinite loop

summary: When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

title: Golang Crypto security vulnerability


product: Cryostat 4 on RHEL 9

product: Red Hat OpenShift Container Platform 4.22

product: RHEM 1.0 for RHEL 9

product: RHEM 1.1 for RHEL 10

product: RHEM 1.1 for RHEL 9

product: external secrets operator for Red Hat OpenShift 1.1

summary: SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

title: Golang Crypto security vulnerability


product: net

ecosystem: windows/system

product: go

summary: The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).


product: Mediawiki - Cargo Extension

vendor: Wikimedia Foundation

product: cargo

vendor: mediawiki

summary: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

title: Mediawiki Cargo security vulnerability


product: MediaWiki - ProofreadPage Extension

status: Awaiting Analysis

summary: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

title: Wikimedia Foundation Mediawiki - Proofreadpage Extension security vulnerability


summary: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

title: Mediawiki Cargo security vulnerability


summary: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

title: Mediawiki Cargo security vulnerability


product: openremote

vendor: openremote

ecosystem: javascript/npm

summary: OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules unrestricted for any user with the write:rules role. Additionally, the Groovy rules engine has a GroovyDenyAllFilter security filter that is defined but never registered, as the registration code is commented out, rendering the SandboxTransformer ineffective for superuser-created Groovy rules. A non-superuser attacker with the write:rules role can create JavaScript rulesets that execute with full JVM access, enabling remote code execution as root, arbitrary file read, environment variable theft including database credentials, and complete multi-tenant isolation bypass to access data across all realms. This issue has been fixed in version 1.22.0.


product: plane

vendor: makeplane

vendor: plane

summary: Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.


product: nicegui

vendor: zauberzeug

summary: NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

title: NiceGUI is a Python-based UI framework


product: weblate

vendor: WeblateOrg

vendor: weblate

summary: Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.


product: siyuan

vendor: siyuan-note

summary: SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, creating a stored XSS sink. Because the desktop renderer runs with nodeIntegration enabled and contextIsolation disabled, attacker-controlled JavaScript executes with access to Node.js APIs. In practice, an attacker can import a crafted note into a synced workspace, wait for the victim to sync, and achieve code execution when the victim opens the note. This vulnerability is fixed in 3.6.4.


product: emmett

vendor: emmett-framework

ecosystem: python/pypi

vendor: emmett

summary: Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emmett__ paths) is vulnerable to path traversal attacks. An attacker can use ../ sequences (eg /__emmett__/../rsgi/handlers.py) to read arbitrary files outside the assets directory. This vulnerability is fixed in 2.8.1.


product: dockyard

summary: Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF protection. A remote attacker can cause a logged-in administrator's browser to request /apps/action.php?action=stop&name=<container> or /apps/action.php?action=start&name=<container>, which starts or stops the target container. This vulnerability is fixed in 1.1.0.


product: FTL

vendor: pi-hole

product: ftldns

summary: Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration field in Pi-hole FTL accepted newline characters without validation, allowing an attacker to inject arbitrary directives into the generated dnsmasq configuration file. On installations with no admin password set (the default for many deployments), the configuration API is fully accessible without credentials, allowing a network-adjacent attacker to inject the payload, enable the built-in DHCP server, and achieve arbitrary command execution on the host the next time any device on the network requests a DHCP lease. The injected value is persisted to /etc/pihole/pihole.toml and survives restarts. The strncpy in the code path limits the total interface field to 31 bytes, but payloads such as wlan0\ndhcp-script=/tmp/p fit within this constraint. The dnsmasq config validation introduced in FTL 6.6 only checks syntactic validity, so valid directives injected via newline pass validation successfully. This issue has been fixed in version 6.6.1.


vendor: yiisoft

summary: Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.

title: Yii 2 is a PHP application framework


product: saleor

vendor: saleor

summary: Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence of user-provided email addresses in error messages. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

title: Saleor is an e-commerce platform


product: quarkus

vendor: quarkusio

product: Cryostat 4 on RHEL 9

product: HawtIO HawtIO 4.4.0

version: vertx-http

product: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27

product: Red Hat build of Quarkus 3.20.6.SP1

product: Streams for Apache Kafka 2.9.4

product: Streams for Apache Kafka 3.2.1

product: OpenShift Serverless

product: Red Hat build of Apache Camel 4 for Quarkus 3

product: Red Hat build of Apicurio Registry 2

product: Red Hat build of Apicurio Registry 3

product: Red Hat build of Debezium 3

ecosystem: java/maven

description: High-severity Quarkus path-normalization authorization bypass. Upgrade supported Quarkus streams, add semicolon path regression tests, and audit path-based security policy for protected APIs.

title: CVE-2026-39852 - Quarkus matrix-parameter authorization bypass

vendor: quarkus

summary: Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.


product: osslsigncode

vendor: mtrojnar

summary: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.


summary: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.


summary: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When processing PE sections for page hashing, the function uses PointerToRawData and SizeOfRawData values from section headers without validating that the referenced region lies within the mapped file. An attacker can craft a PE file with section headers that point beyond the end of the file. When osslsigncode computes page hashes for such a file, it may attempt to hash data from an invalid memory region, causing an out-of-bounds read and potentially crashing the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.