CVE-2026-5626 Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getalldata function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export a...

EUVD-2026-50109

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15344

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-5626

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getalldata function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export a...

CVE-2026-15344: Improper Neutralization of Special Elements used in an SQL Command

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-5626: Missing Authorization

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getalldata function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export a...

PT-2026-65687

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get all data function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export...

DEBIAN-CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-16313 Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export User Data versions = 2.2.6...

Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export Detection

The lack of proper authorisation when exporting data from the plugin could allow unauthenticated users to get information about the posts and page of the blog, including their author's username and email. !/usr/bin/env python3 -- coding: utf-8 -- """The lack of proper authorisation when exporting...

ResourceSpace - Metadata Export Detection

In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value. !/usr/bin/env python3 -- coding: utf-8 -- """In Montala ResourceSpace through 9.""" from kittysploit import from lib.protocols.http.httpclient...

Jira Netic Group Export <1.0.3 - Missing Authorization Detection

Jira Netic Group Export add-on before 1.0.3 contains a missing authorization vulnerability. The add-on does not perform authorization checks, which can allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a...

WordPress Visual Form Builder <3.0.8 - Information Disclosure Detection

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. !/usr/bin/env python3 --...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure Detection

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Modern Events Calendar Lite before 5.""" from kittysplo...

WP Attachment Export < 0.2.4 - Unrestricted File Download Detection

The plugin does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress powered site. This includes details of even privately published posts and password protected posts with their passwords revealed ...

EventON Lite < 2.1.2 - Arbitrary File Download Detection

The plugin does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the numeric id of the post...