1100 matches found
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316 ) is vulnerable to unauthenticated privilege escalation . The root cause lies in the Register & Login add-on's before_email_success_msg() function, which whitelists the client-submitted role key ...
CVE-2026-85010
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero...
Astra Linux – Vulnerability in Firefox and Thunderbird
The application failed to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the...
EUVD-2026-76794
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
SummaryOn the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...
GHSA-VV4J-M4VR-F3G6 ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...
WordPress Unlimited Elements For Elementor plugin <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter vulnerability
Reflected Cross-Site Scripting via 'formDataid' Parameter vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.17...
PT-2026-86324
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-19769: Improper Neutralization of Input During Web Page Generation
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-85222
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...
CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...
CVE-2026-85222
D-Link DNS-340L (firmware 1.01B04) is affected by an OS command injection in the Add-On Center component, specifically in /cgi-bin/addon_center.cgi. Manipulation of the f_name, f_url, f_flag, and f_login_user arguments allows remote code execution. The attack requires high privileges (authenticat...
EUVD-2026-70748
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...
CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...
PT-2026-85260
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon center.cgi of the component Add-On Center. Such manipulation of the argument f name/f url/f flag/f login user leads to os command injection. It is...
CVE-2026-85222: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...
CVE-2026-81296
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...