CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

PT-2026-80998

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-13598

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover...

CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions ≤ 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2026-62666

Grav API Plugin (a RESTful API for Grav CMS) prior to 1.0.6 contains a privilege escalation flaw. The UsersController methods createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check that sibling user mutation endpoints enforce. A non-super account holding api.use...

EUVD-2026-62286

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

GHSA-XPR4-8VP6-C87J Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection

Summary The Froxlor AJAX endpoint lib/ajax.php is missing Cross-Site Request Forgery CSRF protection. While the main application lib/init.php enforces CSRF token validation on all state-changing HTTP requests POST/PUT/PATCH/DELETE, the standalone lib/ajax.php endpoint bypasses this mechanism...

GHSA-43GM-9RR3-CX7G Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Summary A stored Cross-Site Scripting XSS vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access customer role to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54347

In Froxlor prior to 2.3.8, a low-privileged authenticated customer can store JavaScript in a DNS TXT record; it is rendered unescaped via the Twig |raw filter and an unescaped Text::wordwrap callback, auto-executing when an admin views the DNS table, enabling session theft and full admin account ...

CVE-2026-45128

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

EUVD-2026-60607

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

GHSA-P845-629J-RCJ6 New API: Admin can reset passkeys for same-level or higher-privileged users

Summary The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts. Impa...

New API: Admin can reset passkeys for same-level or higher-privileged users

Summary The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts. Impa...

CVE-2026-64866

In New API (v0.9.1.3 to before 1.0.0-rc.7), the AdminResetPasskey function in controller/passkey.go omits the canManageTargetRole authorization check on DELETE /api/user/:id/reset_passkey, letting a lower-privileged admin remove a passkey from a same-level or higher-privileged account, including ...