CVE-2026-19358

The CVE-2026-19358 entry concerns a weakness in 3CORESec Trapdoor, affecting the DefaultFunction up to version 1.2.2. The manipulation leads to improper access controls, with the attack described as remotely initiable over the network. Connected documents corroborate the affected component and th...

EUVD-2026-54929

A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure...

EUVD-2026-54920

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

EUVD-2026-54918

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

CVE-2026-19345

In code-projects Task Management System 1.0, the vulnerable component is the file /user/UpdateTaskStatus.php. The issue arises from manipulation of the arguments task_id/val, leading to missing authorization. It enables remote exploitation, and the exploit has been made public. No remediation ste...

EUVD-2026-54911

A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Password results in improper authentication. The attack is possible to be carried out remotely. The...

CVE-2026-17017

The CVE-2026-17017 entry concerns the CubeWP Framework WordPress plugin prior to version 1.1.31. The vulnerability arises from insufficient sanitization/escaping of a parameter used in an SQL statement within an AJAX action and the absence of a capability check on that action. This combination al...

EUVD-2026-54884

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

EUVD-2026-54882

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-18473

Affected product: WP Directory Kit WordPress plugin prior to 1.5.5. Vulnerable component: parameter handling in field_search where input is unsafely used in a SQL statement. Root cause: insufficient sanitisation/escaping leading to SQL injection. Impact: unauthenticated attackers can exploit the ...

EUVD-2026-54876

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...

CVE-2026-18603

The CVE concerns the PiWeb Cancel order / Refund request plugin for WooCommerce (WordPress) prior to version 1.3.4.34. The issue is a lack of authorization/ownership checks when adding contents of a previous order to the cart, enabling unauthenticated users to disclose other customers’ order cont...

CVE-2026-18464

The CVE‑2026‑18464 entry concerns the WP MAPS PRO WordPress plugin prior to 6.1.3. A capability check is missing in an AJAX action that is accessible to unauthenticated users, and the dispatched operation is not restricted. This allows unauthenticated attackers to trigger uncontrolled recursion, ...

EUVD-2026-54880

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

EUVD-2026-54879

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

EUVD-2026-54877

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-18037

The CVE concerns the Create WordPress plugin (before 2.5.4). A public REST API route does not perform an authorization check, and renders content while also publishing it as a side effect, allowing unauthenticated disclosure of unpublished content and public publication of that content. Affected:...

CVE-2026-18465

The CVE refers to the WP MAPS PRO WordPress plugin (pre-6.1.3) where an AJAX action, reachable without authentication, lacks a capability check and improperly validates a user-controlled path before a file inclusion. This enables unauthenticated attackers to include and execute arbitrary existing...

CVE-2026-18357

The CVE-2026-18357 affects the WPC Order Tip for WooCommerce WordPress plugin prior to version 3.3.1. The vulnerability arises because a reporting feature does not perform authorization or nonce checks, allowing unauthenticated access to sensitive customer order data such as billing names, order ...

EUVD-2026-54878

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...