CVE-2026-87892

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

EUVD-2026-76803

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2025-60375

CVE-2025-60375 CVE-2025-60375 — Bypass de autenticación / control de acceso incorrecto en PerfexCRM 3.3.1 inicio de sesión de administrador Resumen Tipo de vulnerabilidad: Control de acceso incorrecto — Bypass de autenticación Producto afectado: PerfexCRM 3.3.1 CVE: CVE-2025-60375 Publicada...

CVE-2026-77793

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...

EUVD-2026-70046

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-77793 RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...

TYPO3 CMS - Unrestricted File Upload in Form Framework

Problem Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured - uploading PHP files was not possible. The restriction was not enforced server-side because the MimeTypeValidator was registered during form buildi...

GHSA-MFQJ-CQV3-H7XW TYPO3 CMS - Unrestricted File Upload in Form Framework

Problem Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured - uploading PHP files was not possible. The restriction was not enforced server-side because the MimeTypeValidator was registered during form buildi...

CVE-2026-40465

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-40465

Nokia NSP (Network Service Platform) is vulnerable to an open redirect caused by insufficient server-side validation of the URL or redirect parameter. An attacker can craft a malicious URL that redirects users to an untrusted destination, potentially facilitating phishing attacks. The CVSS 3.1 sc...

CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

CVE-2026-76945

CVE-2026-76945 affects the Ebyte NE2-D11 device. The root cause is client-managed authentication tokens without sufficient server-side validation , allowing an attacker to replay or manipulate tokens to gain unauthorized access to administrative functionality . The primary impact is confidentiali...

CVE-2026-15985

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-16986

The Booking Package WordPress plugin (versions before 1.7.25 ) contains an unauthenticated price manipulation vulnerability. The plugin fails to validate the payment amount server-side against the stored service price, instead deriving the expected charge from attacker-supplied request values (se...

CVE-2026-16986 Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price...

CVE-2026-2334

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

CVE-2026-2334

vsDesk v14.0101 is affected by a missing server-side file extension validation in the "Import via CSV" component. An authenticated attacker with administrative privileges can bypass client-side validation to upload an arbitrary file, leading to Remote Code Execution (RCE) within the web applicati...

EUVD-2026-63566

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

PT-2026-79088

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...