Cost Calculator Builder <= 3.2.15 - SQL Injection

The Cost Calculator Builder plugin for WordPress is vulnerable to SQL Injection via discount codes in versions up to, and including, 3.2.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

MAL-2026-12504 Malicious code in @cy4dev/cydemo-bg-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0 @cy4dev/[email protected] ships a postinstall lifecycle script src/postinstall.js that runs at npm install time and invokes node:childprocess.exe...

CVE-2026-7753

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-7753 Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

EUVD-2026-53033

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-7753

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-7753

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-14900

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...

CVE-2026-14900 Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...

CVE-2026-14900 Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...

EUVD-2026-50268

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...

CVE-2026-14900

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...

CVE-2026-14900

The CVE-2026-14900 entry concerns the WordPress plugin Cost Calculator Builder PRO (versions up to 4.0.3). The root cause is insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside the js_to_php(...

EUVD-2026-46965

Vulnerability in the PeopleSoft Enterprise CS Financial Aid product of Oracle PeopleSoft component: FM Need Analysis Calculator. The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft...

CVE-2026-60607

Vulnerability in the PeopleSoft Enterprise CS Financial Aid product of Oracle PeopleSoft component: FM Need Analysis Calculator. The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft...

CVE-2026-10865

CVE-2026-10865 affects the Cost Calculator Builder plugin for WordPress. The vulnerability exists in all versions up to 4.0.11 and arises from exposure in the template body, allowing unauthenticated attackers to read plaintext payment gateway secrets (Stripe secret key, Razorpay secret key, and P...

CVE-2026-10865 Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the template body. This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal...

EUVD-2026-43152

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the template body. This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal...

PYSEC-2026-1264 Composio Eval Injection Vulnerability

In composiohq/composio version 0.4.3, the mathematicalcalculator endpoint uses the unsafe eval function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval function...

PYSEC-2026-1266 Composio Code Injection Vulnerability

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been...