EUVD-2026-67013

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

CVE-2026-81677 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

CVE-2026-81675 Multiple Vulnerabilities in TOOOLS' iSquad

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81675 Multiple Vulnerabilities in TOOOLS' iSquad

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81675

CVE-2026-81675 is an SQL injection vulnerability in TOOOLS' iSquad , specifically in the endpoint /ws/apiprensa/getVideoUltimasSeccion via the id_seccion parameter. The parameter is directly embedded in a complex SQL query involving grouping and sorting operations, allowing an attacker to disrupt...

EUVD-2026-67010

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the idambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

EUVD-2026-67008

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

CVE-2026-81673 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

CVE-2026-81673

CVE-2026-81673 affects the TOOOLS iSquad application, where the /ws/apitribuna/setVisita endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The root cause is the absence of input validation or sanitization before these values are embedded in SQL queries. A remo...

CVE-2026-81673 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

WordPress GeoDirectory plugin < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint vulnerability

Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint vulnerability discovered by Usama Arshad in WordPress Plugin GeoDirectory versions 2.8.169...

WordPress Events Manager plugin < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads vulnerability

Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads vulnerability discovered by Usama Arshad in WordPress Plugin Events Manager versions 7.4...

CVE-2026-81662

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

CVE-2026-81658

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-59355

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability

Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability discovered by ryan fabella in WordPress Plugin MultiVendorX versions 5.0.11...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability

Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

WordPress Dokan plugin < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability

Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Dokan versions 5.0.11...

WordPress Dokan plugin < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability

Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability discovered by Shivamani Vastrala in WordPress Plugin Dokan versions 5.0.9...

WordPress Academy LMS plugin < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint vulnerability

Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint vulnerability discovered by Pedro Pinho in WordPress Plugin Academy LMS versions 3.8.3...