CVE-2026-84281

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.5.2 . The vulnerability exists in the productTitle field of the _fpd_data Order Item Meta due to insufficient input sanitization and output escaping. Unauthenti...

CVE-2026-84281 Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in 'fpddata' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

PT-2026-98366

Name of the Vulnerable Software and Affected Versions Fancy Product Designer versions prior to 6.5.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs when the fpd save order AJAX action, registered...

PT-2026-98373

Name of the Vulnerable Software and Affected Versions Bookly versions prior to 28.3 Description The Bookly plugin for WordPress contains an Insecure Direct Object Reference IDOR flaw. This occurs because the bookly get form id handler stores an attacker-controlled order id from the form data into...

CVE-2026-84281: Improper Neutralization of Input During Web Page Generation

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in 'fpddata' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-97324

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...

EUVD-2026-86409

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...

CVE-2026-97324 YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...

CVE-2026-97324

The YunaiV/zhijiantianya ruoyi-vue-pro application (up to version 2026.08) is vulnerable to improper authorization in the Demo-order Payment Callback Handler component. Specifically, the updateDemoOrderPaid function in yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/de...

EUVD-2026-85332

REDAXO: Unwhitelisted ORDER BY Column in rexlist Allows Authenticated Column Enumeration...

GHSA-4F5F-J737-PM58 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Summary The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable. Although the value is wrapped in backticks via escapeIdentifier preventing classical SQL injection, this still...

CVE-2026-93231: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: lockd: fix swapped arguments in nlmsvcmatchip When releasing locks by server IP address via /proc/fs/nfsd/unlockip, nlmsvcunlockallbyip calls nlmtraversefiles with the server sockaddr as the opaque @data argument:...

CVE-2026-97324: Improper Authorization

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...

PT-2026-98260

Name of the Vulnerable Software and Affected Versions YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09 Description Improper authorization exists in the Demo-order Payment Callback Handler component. A remote attacker can manipulate the ID argument within the updateDemoOrderPaid functi...

GHSA-26R5-4MM2-PX5C Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Location: core/kapp/market/market.go — Buy approx. L281–436\ Severity: High The native marketplace enforces an IsClaimed guard in Claim market.go:752, CancelOrder market.go:1125, and orderEscrowAmount market.go:251, but not in Buy. Marketplace escrow is virtual: the market KApp account never...

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Location: core/kapp/market/market.go — Buy approx. L281–436\ Severity: High The native marketplace enforces an IsClaimed guard in Claim market.go:752, CancelOrder market.go:1125, and orderEscrowAmount market.go:251, but not in Buy. Marketplace escrow is virtual: the market KApp account never...

CVE-2026-82406 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the...

DRUPAL-CONTRIB-2026-179

This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order...

CVE-2026-62998

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-96599 Isotope eCommerce through 2.9.10 Weak Order Identifier Generation

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...