14402 matches found
WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability
Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...
PT-2026-78988
Name of the Vulnerable Software and Affected Versions eShipper Commerce versions prior to 2.16.14 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a versio...
CVE-2026-74014: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
CVE-2026-73402: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...
CVE-2026-74016: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74013: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...
PT-2026-78974
Name of the Vulnerable Software and Affected Versions Homlisti versions prior to 3.1.3 Description Broken access control exists for subscribers, allowing unauthorized access or actions. Recommendations Update to a version newer than 3.1.2...
PT-2026-78991
Name of the Vulnerable Software and Affected Versions Warehouse Cargo versions prior to 2.7.0 Description An issue allows subscribers to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the server. Recommendations Update to a version newer than 2.6.9...
PT-2026-78963
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
CVE-2026-66647: Missing Authorization
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-73998: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-66601: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
PT-2026-78978
Name of the Vulnerable Software and Affected Versions Leyka versions prior to 3.32.4 Description Broken authentication exists for subscribers, allowing potential unauthorized access to accounts. Recommendations Update to a version newer than 3.32.3...
PT-2026-78986
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
PT-2026-78958
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
CVE-2026-66594: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
CVE-2026-73992: Improper Control of Generation of Code
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
PT-2026-78984
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...