CVE-2026-15142

The CVE-2026-15142 entry documents a Privilege Escalation vulnerability in the WordPress plugin Real Estate Manager Pro up to version 12.8.6, caused by improper capability handling in the allow_attachment_actions() function. An authenticated user with Subscriber-level access or higher can escalat...

CVE-2026-15142 Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

EUVD-2026-59597

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...

CVE-2026-16611

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...

CVE-2026-16611

The Product Feed PRO for WooCommerce plugin (before 13.5.7) exposes a REST read route without authorization checks, letting unauthenticated attackers retrieve feed rules, filters, field mappings, and the full product category taxonomy. CVSS 3.1 scores this HIGH (7.5) for confidentiality impact. E...

CVE-2026-16611 Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...

EUVD-2026-59590

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...

PT-2026-72879

Name of the Vulnerable Software and Affected Versions Real Estate Manager Pro versions prior to 12.8.7 Description Improper capability handling in the allow attachment actions function allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to...

PT-2026-73040

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The...

PT-2026-73041

Name of the Vulnerable Software and Affected Versions LB-LINK X-PRO version 1.0.22-20231206 Description A security flaw exists in the /etc/config/easycwmp file that allows for the use of hard-coded credentials. This issue can be exploited remotely, although the attack is considered highly complex...

CVE-2026-19829

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

CVE-2026-19828

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19829

Affected product: 648540858 wvp-GB28181-pro 2.7.4-20260107. The vulnerability resides in the Log File Download Endpoint, specifically LogController.java, where manipulation of the fileName argument enables path traversal. Remote exploitation is possible, and public exploits have been released. CV...

CVE-2026-19829 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

EUVD-2026-58660

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

CVE-2026-19829 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

CVE-2026-19829

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

CVE-2026-19828 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19828

CVE-2026-19828 affects 648540858 wvp-GB28181-pro version 2.7.4-20260107, specifically the Snapshot Endpoint’s PlayController.java. The vulnerability arises from manipulation of the deviceId/channelId argument, enabling path traversal. The attack can be remote, with a publicly available exploit (e...

EUVD-2026-58659

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...