CVE-2025-7605

CVE-2025-7605 code-projects AVL Rooms Project V1.0/profile.php SQL injection NAME OF AFFECTED PRODUCTS AVL Rooms Vendor Homepage https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ submitter dazhi Vulnerable File /profile.php VERSIONS V1.0 Software Link...

CVE-2026-119156

The Download Manager plugin for WordPress (versions

EUVD-2026-119213

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmregfirstname, wpdmreglastname, wpdmreguserlogin' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119156 Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmregfirstname, wpdmreglastname, wpdmreguserlogin' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119158

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-119158 Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-119158

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress (versions up to and including 3.8.4.16 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the first_name parameter. An unauthentic...

EUVD-2026-118602

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-119616

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptinfieldsfirstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execut...

CVE-2026-119616 Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptinfieldsfirstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execut...

CVE-2026-119616 Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptinfieldsfirstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execut...

CVE-2026-119616

The Noptin WordPress plugin (versions up to and including 4.4.3 ) is vulnerable to Local File Inclusion (LFI) via the noptin_fields[first_name] parameter. An unauthenticated attacker can store a malicious payload as a subscriber's first_name because the public Manage Preferences page issues a non...

EUVD-2026-118559

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptinfieldsfirstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execut...

CVE-2026-116385

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /editprofile of the component Profile. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiat...

CVE-2026-116385

A cross-site scripting (XSS) vulnerability exists in Bdtask Garage 24 Garage Management Software version 1.0 . The flaw is located within the Profile component, specifically affecting the processing of the /edit_profile file. By manipulating the first_name and last_name arguments, an attacker can...

EUVD-2026-110034

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /editprofile of the component Profile. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiat...

CVE-2026-116385 Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /editprofile of the component Profile. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiat...

CVE-2026-116385 Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /editprofile of the component Profile. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiat...

Bdtask Garage 24 Garage Management Software Cross-site Scripting Vulnerability

Version 1.0 of Bdtask Garage 24 Garage Management Software contains a security vulnerability. This vulnerability stems from improper handling of the firstname and lastname parameters in the /editprofile endpoint, potentially enabling cross-site scripting attacks...

CVE-2026-103380

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'paramscustomerfirstname' parameter. This makes it possible for authenticated attackers, with...