CVE-2026-108506

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information...

CVE-2026-108506 Unauthorized access vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information...

CVE-2026-108506

The ZTE Z80 Ultra is affected by an unauthorized access vulnerability caused by inadequate access control and a lack of robust invocation authentication on its system interfaces. Specifically, third-party applications can utilize reflection to call these interfaces and retrieve sensitive informat...

EUVD-2026-96303

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information...

CVE-2026-108505

The ZTE Z80 Ultra is affected by a local information disclosure vulnerability. Due to improper privilege management (CWE-269 ), third-party applications can capture data returned by system interfaces to obtain device-related information . The base severity is rated as LOW (3.3). No specific explo...

EUVD-2026-96302

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information...

CVE-2026-108505 Information disclosure vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information...

CVE-2026-107712

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-108502

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs...

CVE-2026-107712

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.1.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the user-supplied 'current_month' parameter. This is a regression...

CVE-2026-107712 WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-96215

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-96228

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs...

CVE-2026-108502 Information disclosure vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs...

CVE-2026-108502

The ZTE Z80 Ultra product is vulnerable to an information disclosure vulnerability. This flaw allows third-party applications to read relevant information by hooking system APIs . The vulnerability is associated with CWE-269 (Improper Privilege Management). No specific details regarding affected ...

CVE-2026-108501

ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface...

CVE-2026-101947

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

CVE-2026-108501 Unauthorized access vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface...

CVE-2026-108501

The ZTE Z80 Ultra is impacted by an unauthorized access vulnerability caused by a system interface permission verification defect . Due to a lack of necessary access controls, an attacker can read relevant information by reflectively invoking the interface . The vulnerability is classified under ...

CVE-2026-103365 Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details

The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...