PT-2026-116484

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory data.php that allows authenticated users to bypass the inventory module enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory...

CVE-2026-111914: Missing Authorization

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...

Admidio authorization issue vulnerability

The Admidio versions from 5.0.11 to 5.0.16 have a vulnerability related to authorization. This vulnerability stems from improper access control in modules/inventory/inventorydata.php. Attackers who are already authenticated can bypass the restrictions of the inventorymoduleEnabled setting by maki...

CVE-2026-12126: Improper Neutralization of Input During Web Page Generation

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'posttitle' in all versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for...