CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-88282

GeoVision GV-LPC2211 (LPC series) V1.13 contains a stored command injection vulnerability in its FTP username field. An administrator who sets an FTP username containing shell metacharacters can trigger arbitrary root command execution during a subsequent FTP-account update operation. The vulnera...

CVE-2026-52763 YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...

CVE-2026-19698 GutenKit < 2.5.1 - Contributor+ Stored CSS Injection

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

EUVD-2026-65062

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2026-78541 Command Injection in Parent Control of TP-Link Archer BE3600 v1

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2026-76316 Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...

CVE-2026-72607 Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = itemsbatchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The...

EUVD-2026-52725

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is...

EUVD-2026-49712

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...

CVE-2026-7232

The CVE-2026-7232 entry describes a Stored XSS in the WordPress FormCraft plugin (all versions up to 3.9.14). Root cause: insufficient input sanitization and output escaping, with a server-side gap where matrix sub-field keys like field2_0/field2_1 bypass the sanitization loop and are stored via ...

CVE-2026-15022

The CVE covers Tutor LMS (WordPress) up to version 4.0.0, where a generic SQL Injection via Stored Quiz Answer Array exists due to insufficient escaping and improper query preparation. The vulnerability is stored at quiz-attempt time (wp_ajax_tutor_quiz_abandon) and only executes when a privilege...

CVE-2026-45535 DataEase: Stored SQL Injection Vulnerability

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultValue entries such as $var and SqlparserUtils.handleVariableDefaultValue inserts them with String.replace without escaping or parameterizatio...

GHSA-89V6-J5X6-CMJ3 YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

Summary The recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces: the URL query string $GET'period' and the action invocation recentchanges period="...". A whitelist at line 17 validates only the URL form against 'day','week','month'. The...

GO-2026-5919 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder...

CVE-2026-9834

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the wpdbexcludetable parameter. This is due to the direct concatenation of user-supplied $POST'wpdbexcludetable' valu...

DEBIAN-CVE-2026-40084

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report formatfile Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage stored injection, lib/htmlreports.php at...

CVE-2026-40084

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report formatfile Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage stored injection, lib/htmlreports.php at...

UBUNTU-CVE-2026-40084

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report formatfile Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage stored injection, lib/htmlreports.php at...

CVE-2026-40084

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report formatfile Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage stored injection, lib/htmlreports.php at...