EUVD-2026-125981

The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator...

CVE-2026-76581-Detector

CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581. The detector does not exploit the authentication bypass, request or replay HMAC values, or create ...

CVE-2026-85984

CVE-2026-85984 — miniOrange OTP Login Auth Bypass Python 3 PoC for CVE-2026-85984 — miniOrange OTP Login, Verification and SMS Notifications ≤ 5.5.5. Description PoCbit / GitHub CVE-2026-85984 — Unauthenticated authentication bypass CWE-287 via POST parameter mowploginintent=otp with an empty...

CVE-2026-126265 SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie

SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator...

EUVD-2026-125256

SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator...

CVE-2026-126265

The SiYuan application, version 2.1.0 before 3.8.9, is vulnerable to a CAPTCHA Bypass due to a flaw in how the loginAuth challenge is handled. The challenge is stored in a signed client-side cookie , which allows an attacker to reuse a previously solved challenge. By replaying the original signed...

EUVD-2026-125073

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store,...

PT-2026-146596

Name of the Vulnerable Software and Affected Versions SiYuan versions 2.1.0 through 3.8.8 Description A flaw exists where the CAPTCHA challenge for the loginAuth process is stored in a signed client-side cookie. This allows an attacker to reuse a previously solved challenge by replaying the signe...

CVE-2026-72898

CVE-2026-72898: Metabase SQL Injection Lab Metabase is an analytics tool that connects to databases to create query results and dashboards. CVE-2026-72898 is a vulnerability that allowed unauthenticated users to inject SQL into the Metabase application DB by adding an unexpected user-id value to...

CVE-2026-113615

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session...

EUVD-2026-117910

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session...

CVE-2026-105413

The Form Maker by 10Web WordPress plugin, in versions before 1.15.51 , is vulnerable to Unauthenticated Stored XSS . The root cause is the inconsistent escaping of user-submitted field values before they are rendered on the plugin's submissions admin page. An unauthenticated attacker can store a ...

CVE-2026-105413 Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values

The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who vie...

CVE-2026-61791 OCO-Server: Stored XSS through agent hostnames in command buttons

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...

CVE-2026-61791 OCO-Server: Stored XSS through agent hostnames in command buttons

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...

CVE-2026-61791 OCO-Server: Stored XSS through agent hostnames in command buttons

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...

CVE-2026-61791

Versions of OCO-Server prior to 1.2.1 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The Html::commandButton() function in lib/Html.class.php incorrectly handles stored computer hostnames by using htmlspecialchars(ENT_QUOTES) for HTML escaping only. Because browsers decode HTML entit...

EUVD-2026-103058

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default appsecret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenantdemo' to gain full tena...

CVE-2026-111636: Use of Hard-coded Cryptographic Key

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default appsecret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenantdemo' to gain full tena...

EUVD-2026-102308

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...