CVE-2026-115223: Unknown Smart Popup by Supsystic: The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being…

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

C97net qEngine CMS information disclosure vulnerability

C97net qEngine CMS versions 6.0.0 and earlier, Kemana Directory versions 1.5.6 and earlier, and Cart Engine versions 3.0.0 and earlier contain an information disclosure vulnerability. This vulnerability arises because the /admin/backup directory, accessible via the web, exposes database backups...

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector database for semantic search. The AI Search submodule has always been marked as 'experimental' but more importantly is deprecated. You m...

AXIS Camera Station Pro encryption issue vulnerability

Versions 6.0 through 6.19 of AXIS Camera Station Pro, as well as version 5.00 and later of AXIS Camera Station, contain an encryption vulnerability. This vulnerability stems from insufficient encryption strength in database backups, making them susceptible to offline attacks that could lead to...

Futurum Software User Authentication Module SQL injection vulnerability

Versions of the Futurum Software User Authentication Module prior to May 2026 contain an SQL injection vulnerability. This vulnerability stems from insufficient validation and sanitization of user-supplied input, as well as improper WAF configuration. It may allow unauthenticated attackers to...

PT-2026-127910

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms t...

CVE-2026-63286: Axis Communications AB: Database backups are vulnerable to offline attacks

Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the...

PT-2026-128092

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

PT-2026-127880

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsm showTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

PT-2026-127797

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names...

OpenCATS input validation error vulnerability

Versions prior to OpenCATS 0.10.0 contain a security vulnerability. This vulnerability stems from insufficient validation or escaping of the period, startDate, and endDate parameters in the activity DataGrid date filtering within modules/home/dataGrids.php and modules/activity/dataGrids.php. Thes...

MongoDB Database Tools encryption issue vulnerability

Versions of MongoDB Database Tools prior to 100.20.0 contain an encryption-related vulnerability. This vulnerability stems from the reliance on the TLS implementation within the Go standard library and the use of a system CA for storage; however, Go version 1.26.8 does not include the crypto/x509...

WordPress VikRentCar Car Rental Management System SQL injection vulnerability

WordPress VikRentCar Car Rental Management System versions 1.4.10 and earlier contain an SQL injection vulnerability. This vulnerability stems from insufficient escaping of the catid parameter and inadequate preparation for existing SQL queries; it is susceptible to blind SQL injection attacks. A...

Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an...

CVE-2026-61567: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-116609: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and…

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-115224: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a…

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an...

CVE-2026-61569: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-76005: chuck1982 WP Inventory Manager: The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode…

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-58257

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...