1058 matches found
Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting
The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'planicons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...
CVE-2026-15414
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the savemetaboxes function persisting the wpsplanuserrole membership plan meta from $POST without an allowlist that excludes privileged roles — the...
CVE-2026-15414
CVE-2026-15414 affects the Subscriptions for WooCommerce plugin for WordPress, is_role(), both accepting administrator, and the UI’s disabled attribute is client-side-only, enabling bypass by POST or DevTools. Because wps_membership_plan is registered with capabilty_type => 'post', any user wh...
CVE-2026-15414 Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the savemetaboxes function persisting the wpsplanuserrole membership plan meta from $POST without an allowlist that excludes privileged roles — the...
ROS-20260724-73-0048
The vulnerability of the JOIN::fixallsplittingsinplan function in the MariaDB database management system is related to improper behavior. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
CVE-2023-37507
HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed...
CVE-2023-37508
HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...
CVE-2023-37507 An information disclosure vulnerability affects HCL DevOps Plan
HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed...
EUVD-2023-60604
HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed...
CVE-2023-37507
Technical details for CVE-2023-37507 are not publicly available in the provided documents. The descriptions only state an information disclosure in HCL DevOps Plan. Monitor sources for updates and new technical details.
CVE-2023-37508
Technical details for CVE-2023-37508 are not publicly available in the provided documents. Monitor for updates from vendors and security feeds for affected products, versions, root cause, and mitigation steps.
EUVD-2023-60603
HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...
CVE-2023-37508 HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability
HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...
PT-2026-61823
HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...
CVE-2026-47198 Paymenter: URL parameter injection bypasses paid plan limits at checkout
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because...
CVE-2026-47198 Paymenter: URL parameter injection bypasses paid plan limits at checkout
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because...
Oracle Linux 10 : python3.14-pip (ELSA-2026-36193)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36193 advisory. 25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion +...
python3.14-pip security update
25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion + remove unused metadata file 25.2-4 - Security fix for CVE-2026-8643: path traversal in wheel entry points...
CVE-2026-5269
In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...
CVE-2026-5269
Technical details about CVE-2026-5269 are not publicly available in the provided documents; no affected product versions, exploit information, or remediation specifics are included. Monitor for updates.