CVE Feed

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

Administrator SQL Injection in Leyka <= 3.32.3 versions.

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.

Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration &amp; Cloning: from n/a through 1.5.19.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8.

Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

Missing Authorization vulnerability in pubjet Pubjet | پاب‌جت pubjet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pubjet | پاب‌جت: from n/a through 5.4.8.

Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.

phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.

OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.