CVE-2026-85222

D-Link DNS-340L (firmware 1.01B04) is affected by an OS command injection in the Add-On Center component, specifically in /cgi-bin/addon_center.cgi. Manipulation of the f_name, f_url, f_flag, and f_login_user arguments allows remote code execution. The attack requires high privileges (authenticat...

EUVD-2026-70748

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85222: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

PT-2026-85260

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon center.cgi of the component Add-On Center. Such manipulation of the argument f name/f url/f flag/f login user leads to os command injection. It is...

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297

Fluent Forms Pro Add On Pack is a WordPress plugin affected by a Subscriber Privilege Escalation vulnerability in versions ≤ 6.2.12 , as discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-based attac...

EUVD-2026-68782

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

EUVD-2026-68781

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

PT-2026-84006

Name of the Vulnerable Software and Affected Versions Fluent Forms Pro Add On Pack versions prior to 6.2.13 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 6.2.12...

PT-2026-84007

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296: Missing Authorization

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.12...

CVE-2026-13736 NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

CVE-2026-13736: Improper Access Control

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

PT-2026-79298

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...