1273 matches found
EUVD-2026-83569
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-91017 Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...
CVE-2025-67261
CVE-2025-67261 - Abacre Retail Point of Sale 14.0.0.396 におけるコンテンツベースのブラインドSQLインジェクション Abacre Retail Point of Sale 14.0.0.396 は、コンテンツベースのブラインドSQLインジェクションに対して脆弱です。この脆弱性は、注文ページの検索機能に存在します。 「注文」ページの「検索」機能は、コンテンツベースのブラインドSQLインジェクションに対して脆弱です。...
CVE-2026-14562
The teddy-bear-customize-addon WordPress plugin (versions through 1.0.5 ) fails to perform authorization or ownership checks before returning WooCommerce order metadata and customer-uploaded attachment URLs . This allows unauthenticated attackers to disclose other customers' order and attachment ...
CVE-2026-11496
The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders
A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders
A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders
A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...
CVE-2026-86170
A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the...
MiracleLinux 8 : freerdp-2.11.7-12.el8_10 (AXSA:2026-1756:28)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1756:28 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafte...
CVE-2026-84849
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...
EUVD-2026-70597
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...
CVE-2026-84849 WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...
CVE-2026-84849
CVE-2026-84849 affects the Pre-Orders for WooCommerce WordPress plugin in versions 2.3 and earlier . The vulnerability is an unauthenticated bypass , meaning no prior login is required to exploit it. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicati...
WordPress Pre-Orders for WooCommerce plugin <= 2.3.1 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by MoonFuji in WordPress Plugin Pre-Orders for WooCommerce versions = 2.3.1...
PT-2026-85123
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...
MiracleLinux 9 : freerdp-2.11.7-7.el9_8.6 (AXSA:2026-1752:27)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1752:27 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafte...
EUVD-2026-70046
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders
A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...
RLSA-2026:61379 Important: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP...