Login Configurator <=2.1 - Cross-Site Scripting

Login Configurator WordPress plugin = 2.1 contains a reflected cross-site scripting caused by improper escaping of URL parameter before outputting it to the page, letting attackers execute scripts in the context of site administrators, exploit requires victim to visit a malicious URL. id:...

Oracle E-Business Suite - Server-Side Request Forgery

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. id:...

EUVD-2026-106779

Vulnerability in the PeopleSoft Enterprise FIN Product Configurator Brazil product of Oracle PeopleSoft component: Product Configurator. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft...

EUVD-2026-106429

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards component: Configuration Management. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards...

CVE-2026-91553

Vulnerability in the PeopleSoft Enterprise FIN Product Configurator Brazil product of Oracle PeopleSoft component: Product Configurator. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft...

CVE-2026-87388

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards component: Configuration Management. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards...

CVE-2026-91553

A vulnerability exists in the Product Configurator component of Oracle PeopleSoft Enterprise FIN Product Configurator Brazil (version 9.1 ). This easily exploitable flaw allows a low-privileged attacker with local infrastructure access to compromise the product. Successful exploitation can lead t...

CVE-2026-87388

A vulnerability exists in the Configuration Management component of JD Edwards EnterpriseOne Configurator (version 9.2) from Oracle JD Edwards. A low-privileged attacker with network access via HTTP can exploit this difficult-to-exploit vulnerability to compromise the product. Successful exploita...

PT-2026-119705

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards component: Configuration Management. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards...

PT-2026-120056

Vulnerability in the PeopleSoft Enterprise FIN Product Configurator Brazil product of Oracle PeopleSoft component: Product Configurator. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft...

Oracle JD Edwards EnterpriseOne Configurator security vulnerabilities

Oracle JD Edwards EnterpriseOne Configurator 9.2 has a security vulnerability. This vulnerability stems from issues with the Configuration Management component, which may allow attackers with low privileges to access through the HTTP network, and to unauthorizedly create, delete, or modify critic...

Oracle PeopleSoft Enterprise FIN Product Configurator Brazil security vulnerability

Oracle PeopleSoft Enterprise FIN Product Configurator Brazil version 9.1 contains a security vulnerability stemming from issues within the Product Configurator component. This vulnerability may allow low-privilege attackers to log in and execute infrastructure tasks, thereby unauthorizedly...

Exploit for CVE-2026-103889

CVE-2026-103889 PoC: Expivi Unauthenticated Remote Code Execut...

WordPress Expivi 3D Product Configurator for WooCommerce 2.16.2 Unauthenticated Remote Code Execution

WordPress Expivi 3D Product Configurator for WooCommerce plugin versions through 2.16.2 contain an unauthenticated remote code execution vulnerability via the xpvimage parameter. The proof of concept executes a command and returns its output. https://packetstorm.news/download/235220...

CVE-2026-103889

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

CVE-2026-103889

The 3D Product configurator for WooCommerce plugin for WordPress (versions

EUVD-2026-96055

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

PT-2026-109482

Name of the Vulnerable Software and Affected Versions 3D Product configurator for WooCommerce versions prior to 2.16.3 Description Remote Code Execution is possible due to missing authentication and nonce checks on the wp loaded handler. The issue occurs because the xpv image POST parameter is no...