CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-61529 Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous "POST /forms/formId/submissions" endpoint stores attacker-controlled "JsonData" after checking only that the JSON is well formed. A file object with "name", "type" and "content" fields...

CVE-2026-61529 Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

EUVD-2026-112410

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

PT-2026-129171

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-61529: Server-Side Request Forgery (SSRF)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

EUVD-2026-110532

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

CVE-2026-104461

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-104461 YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-104461

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

EUVD-2026-91472

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-104461 YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

PT-2026-104271

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-104461: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-87777

The Hostinger Reach WordPress plugin (versions 1.0.6 through 1.8.2) is vulnerable to Stored XSS because it fails to sanitize and escape a widget setting before outputting it in the editor preview. This flaw specifically involves the formId Elementor Widget Attribute . An attacker with contributor...

CVE-2026-87777 Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

CVE-2026-87777 Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

EUVD-2026-86540

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

PT-2026-98367

Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce versions prior to 5.120.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can permanently...