CVE-2026-72747 AVideo Stored Cross-Site Scripting via Unauthenticated Registration

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected...

CVE-2026-72747 AVideo Stored Cross-Site Scripting via Unauthenticated Registration

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected...

CVE-2026-72747

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected...

CVE-2026-72747: Improper Neutralization of Input During Web Page Generation

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected...

CVE-2026-16030

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...

EUVD-2026-54385

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...

CVE-2026-16030 MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...

CVE-2026-16030

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...

CVE-2026-16030

The MStore API WordPress plugin (versions before 4.21.0 ) is vulnerable to an unauthenticated account takeover. The root cause is an improper verification of the cryptographic signature for tokens used during phone-based login authentication. An unauthenticated attacker who knows a registered use...

CVE-2026-65570

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

EUVD-2026-53988

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65570

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65570 WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-65570

Technical details about CVE-2026-65570 are not publicly available in the provided documents. The records only state an unauthenticated bypass in the WordPress plugin up to version 1.8.70; no specifics on exploit vectors or fixes are included. Monitor for updates.

WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Bypass vulnerability vulnerability discovered by she11f in WordPress Plugin Login with phone number versions = 1.8.70...

CVE-2026-8029

The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the thef...

EUVD-2026-53292

The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the thef...

CVE-2026-8029

The CVE-2026-8029 entry concerns a SQL injection in the ZTE Smart Life app that permits UNION SELECT queries to access data in the feedback.db database. The vulnerability can expose sensitive information across tables, including user accounts, phone numbers, feedback content, and local debug log ...

CVE-2026-8029

The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the thef...

CVE-2026-15210

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...