CVE-2026-110185

The Bit Flows: AI Agent Automation & Integrations plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.31.0 . The vulnerability exists in the 'image' parameter (used by the ImageHelper node's mix tag). An unauthenticated attacker can include and e...

CVE-2026-110185 Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

CVE-2026-110185 Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

CVE-2025-15443

CRMEB up to 5.6.1 contains a SQL injection in the adminapi/product/product_export endpoint via manipulated cate_id during request processing. The issue is remotely exploitable with a publicly available exploit; affected versions are 5.6.1 and earlier. Remediation per PT security notes is to upgra...