EUVD-2026-62286

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

EUVD-2026-62276

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin, in versions before 4.4.8 , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape certain query-string parameters reflected on one of its admin pages. Attackers can exploit this ...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

EUVD-2026-62270

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-23938

A flaw was found in Zabbix. An authenticated administrator can exploit this vulnerability by creating specially crafted JavaScript scripts within preprocessing or script items. This can lead to a denial of service DoS by crashing the Zabbix server or proxy. Mitigation Restrict administrative acce...

CVE-2026-70408

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

EUVD-2026-62238

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

CVE-2026-76050

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-76049

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-76048

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

CVE-2026-76049

CVE-2026-76049 is a SQL injection in SourceCodester Simple Online Food Ordering System 1.0, triggered via the ID argument in /admin/ajax.php?action=save_menu, exploitable remotely with no authentication; CVSS 7.3 HIGH, exploit code maturity PoC, but no specific in-the-wild exploitation evidence i...

EUVD-2026-62227

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-78768

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store malicious Search...

PT-2026-78331

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.15 Description An unauthenticated remote code execution RCE flaw exists, allowing an attacker to execute arbitrary code on the server without requiring authentication. Recommendations Update JetEngine to version...

PT-2026-78342

Name of the Vulnerable Software and Affected Versions Outranking Plugin versions prior to 1.1.4 Description Broken access control allows unauthenticated users to access the options of the Outranking Plugin. Recommendations Update to a version newer than 1.1.3...

PT-2026-78284

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...