CVE-2026-49850 InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

EUVD-2026-87128

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores clientemail values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote...

CVE-2026-85293 InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores clientemail values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote...

CVE-2026-85293

The self-hosted open source application InvoicePlane is vulnerable to Stored Cross-Site Scripting (XSS) in version 1.7.2-beta-1 . The root cause is the failure to enforce email syntax on client_email values, which are then rendered unescaped within double-quoted attributes in the invoice mailer a...

EUVD-2026-87126

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensurevalidpostrequest from delete methods including Payments::delete, Recurring::delete, and Userclients::delete. Although the routes require POST, they do not...

CVE-2026-85289 InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensurevalidpostrequest from delete methods including Payments::delete, Recurring::delete, and Userclients::delete. Although the routes require POST, they do not...

CVE-2026-17602

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

CVE-2026-12037

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-12037

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 1.4.0.5 . The vulnerability exists via the 'page_url' parameter and is only exploitable when an administrator has configured the plugin's dom_get_type...

CVE-2026-12037 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

EUVD-2026-86575

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-12037 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-17602

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to a Directory Traversal (Path Traversal) vulnerability in all versions up to and including 4.7.42 . The root cause is a flaw in handling the 'file_name' parameter. This allows authenticated attackers wit...

EUVD-2026-86599

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

CVE-2026-17602 SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

CVE-2026-17602 SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

PT-2026-98958

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description A security filter protecting the AI Agent configuration can be bypassed by entering specially crafted text into an AI Agent field. An administrator with permissions to create or edit AI Agents can...

PT-2026-98356

Name of the Vulnerable Software and Affected Versions Elementor Website Builder versions 4.3.0 through 4.3.1 Elementor Pro versions 4.3.0 through 4.3.1 Description A Cross-Site Request Forgery CSRF flaw exists where a logged-in administrator can be tricked into opening a crafted link, leading to...

PT-2026-99132

Name of the Vulnerable Software and Affected Versions Flame versions prior to 2.4.1 Description An improper restriction of excessive authentication attempts exists in the 'POST /api/auth' login endpoint. This allows unauthenticated attackers to perform brute-force attacks against the admin passwo...

CVE-2026-100501: Improper Restriction of Excessive Authentication Attempts

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...