CVE Feed

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WofficeIO Woffice woffice allows SQL Injection.This issue affects Woffice: from n/a before 5.4.43.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.

Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lumise Lumise Product Designer lumise allows Reflected XSS.This issue affects Lumise Product Designer: from n/a before 2.1.4.1.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-1829.

Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.

Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.

Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2.

Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.

Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.

A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and cryptographic keys. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to backend and cloud resources and forge client requests on the targeted system.

Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as the callback’s id_token parameter. The issue only manifests when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that zone’s own /oauth/token endpoint (a “self-UAA” OIDC configuration). In this configuration, the callback takes a supplied id_token directly instead of requiring the authorization code exchange, and does not verify that the token was actually issued as an ID token for the specific self-OIDC relying-party client. An attacker holding any valid UAA JWT for themselves — including a plain access token with only uaa.user scope, or a valid ID token issued to an unrelated client such as cf — can present it as the callback’s id_token and be authenticated into a mapped local (“shadow”) account. Because the resulting session is not verified against the originating token’s true audience or user_id, its effective privilege depends entirely on the shadow account’s group memberships, which can include administrative scopes such as clients.write. Exploitation requires a valid UAA user JWT, a valid browser login state for the target zone, and the presence of a self-referential OIDC provider configuration — this is not a pre-authentication vulnerability, and does not by itself grant privileges beyond those already held by the mapped shadow account.

Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret. UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret. Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.

A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

Memory corruption while processing service requests.

Memory Corruption when executing system service routines due to improper handling of user input buffers.

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.

Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.