Premium Packages – Sell Digital Products Securely - SQL Injection

Premium Packages – Sell Digital Products Securely WordPress plugin = 6.2.0 contains a SQL injection caused by insufficient escaping of 'code' parameter in CouponCodes::find method, letting unauthenticated attackers extract sensitive database information via crafted SQL queries. id: CVE-2026-12800...

CVE-2026-74048

Not Failing Securely Failing Open vulnerability in Apache Tomcat...

CVE-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...

CVE-2026-74048

Apache Tomcat contains a Not Failing Securely ('Failing Open') vulnerability where the OpenSSLLifecycleListener fails to prevent start-up if FIPS activation fails. When configured for FIPS mode but activation fails, the software logs an error but continues to operate using JSSE in non-FIPS mode ....

CVE-2026-74048

Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...

CVE-2026-110664

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-102786

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-115495

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.2.9 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher...

CVE-2026-110664: Improper Neutralization of Input During Web Page Generation

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-18586

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

EUVD-2026-101842

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-18586: Improper Neutralization of Input During Web Page Generation

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-103478

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...

EUVD-2026-96290

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...

CVE-2026-103478: Improper Neutralization of Input During Web Page Generation

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPDM – Premium Packages versions = 7.2.6...

CVE-2026-78022: Not Failing Securely

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely 'Failing Open' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass...

Not Failing Securely ('Failing Open')

Overview org.postgresql:postgresql is a Java JDBC 4.2 JRE 8+ driver for PostgreSQL database. Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' via the requireAuth property when it is configured to exclude all authentication methods or is left empty. An attack...

CVE-2026-100860: Not Failing Securely

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node backend/app/services/nodeexecution/nodes/redisnode.py. When getaccessiblecredential returns None — because the credential ID does not exist or the caller is not authorized to use it —...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...