114695 matches found
CVE-2026-7534 SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy
CVE-2025-24472 — Fortinet FortiOS / FortiProxy Authentication...
PT-2026-63576
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...
PT-2026-63592
The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpagery add filter text template post function, which is hooked to admin footer and echo...
PT-2026-64159
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax Service::verify ajax request helper gating its wp verify nonce call behind the boolean option 'enable nonce check', which is absent from the default...
CVE-2026-48013: Server-Side Request Forgery (SSRF)
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
PT-2026-64199
Name of the Vulnerable Software and Affected Versions Pronetiqs IntraVUE versions 3.2.1a14 and earlier Description The software uses inadequate encryption strength, which may enable an attacker to steal administrator credentials. This can be achieved through a weak hash or a pass-the-hash attack,...
PT-2026-63788
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...
Cisco IOS 12.4 HTTP Server Cross-Site Request Forgery (CVE-2008-4128)
According to its self-reported version, Cisco IOS 12.4 is affected by multiple cross-site request forgery CSRF vulnerabilities in the HTTP administration component. An unauthenticated, remote attacker can exploit these by persuading an authenticated user to follow a malicious link, allowing...
Oracle GoldenGate 21.x < 21.23.0.0.0 (July 2026 CPU)
The 21.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...
PT-2026-63598
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...
PT-2026-64160
This is a textbook authorization bypass in Casdoor CVE-2026-15630 that breaks tenant isolation in multi-tenant deployments. The core issue is a desync between the authz layer and the controller layer. Technical Breakdown: - Root Cause: The global authz filter routers/authzfilter.go uses the ?id=...
PT-2026-63791
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...
CVE-2026-15906: Improper Neutralization of Special Elements used in an SQL Command
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...
PT-2026-63977
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...
PT-2026-64128
Summary A workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role chec...
Oracle GoldenGate 23.x < 23.26.3.0.0 (July 2026 CPU)
The 23.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...
Oracle Primavera Gateway (July 2026 CPU)
The version of Primavera Gateway installed on the remote host is affected by a vulnerability as referenced in the July 2026 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering component: Admin Apache Log4j. Supported versions that are affected are...
Oracle GoldenGate 19.x < 19.32.0.0.260721 (July 2026 CPU)
The 19.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...
