109 matches found
Medium: libstoragemgmt
Issue Overview: A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI Small Computer System Interface Vital Product Data VPD page 0x80 data. This malformed data, specifically an untrusted page length field, can lea...
CVE-2026-119751 Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...
EUVD-2026-117487
Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association data by directly...
CVE-2026-120249
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
CVE-2026-114173
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...
CVE-2026-114173
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...
CVE-2026-114173
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...
CVE-2026-114173: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public…
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...
Canva ortto information disclosure vulnerability
Versions of Canva prior to ortto 1.0.25 contain an information disclosure vulnerability. This vulnerability arises from the failure to filter WooCommerce product data embedded on public storefront pages, potentially allowing unauthenticated attackers to read product passwords and private product...
CVE-2026-86816
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...
WordPress WPCafe plugin < 3.0.21 - Unauthenticated Product Data Disclosure vulnerability
Unauthenticated Product Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WPCafe versions 3.0.21...
CVE-2026-86816
The WPCafe WordPress plugin, in versions before 3.0.21 , contains a vulnerability where certain REST API endpoints do not have proper access restrictions. This flaw allows unauthenticated attackers to access sensitive WooCommerce product data , including private product meta, exact stock levels, ...
CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...
PT-2026-107409
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...
CVE-2026-86816: Exposure of Sensitive Information to an Unauthorized Actor
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...
CVE-2026-84025
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...
EUVD-2026-76792
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...
PT-2026-90576
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...
CVE-2026-84025: Authorization Bypass Through User-Controlled Key
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...
WordPress FiboSearch plugin < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure vulnerability
Unauthenticated Password-Protected Product Information Disclosure vulnerability discovered by Duy Tran in WordPress Plugin FiboSearch versions 1.34.1...