WordPress Testimonials Widget plugin <= 4.0.4 - Unauthenticated Arbitrary Post Update vulnerability

Unauthenticated Arbitrary Post Update vulnerability discovered by Naiches in WordPress Plugin Testimonials Widget versions = 4.0.4...

WordPress Groups – Memberships and Access Control plugin <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Groups versions = 4.6.0...

CVE-2026-82915 Path Traversal in Bimser Solution Software's eBA Plus

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.1...

CVE-2026-82915 Path Traversal in Bimser Solution Software's eBA Plus

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.1...

CVE-2026-82915

The eBA Plus Document and Workflow Management System by Bimser Solution Software Trade Inc. is vulnerable to a Path Traversal vulnerability. This issue affects versions from 6.7.141 before 10.0.11 . The flaw allows for improper limitation of a pathname to a restricted directory. No specific explo...

CVE-2026-85134 Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus

Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11...

CVE-2026-82969 Stored XSS in BİMSER's eBA Plus

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before...

CVE-2026-82915: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.1...

CVE-2026-101144: Improper Access Control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

The vulnerability of the setOpenVpnClientCfg() function in the microprogramming software for Totolink A8000RU allows a hacker to execute arbitrary commands.

The vulnerability of the setOpenVpnClientCfg function in the Totolink A8000RU router’s microprogramming software is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system command...

PT-2026-102344

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software version 9.7.0 Description Improper access controls exist within the Query Builder component, specifically affecting the '/callrec/searchAction.do' endpoint. This flaw allows for remote exploitation. Recommendatio...

PT-2026-102345

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

The vulnerability of TP-Link Archer VX1800v V1’s microprogramming software lies in the failure to implement measures to eliminate CRLF sequences. This allows attackers to alter user account roles and gain administrator privileges.

The vulnerability of TP-Link Archer VX1800v V1 microprogramming software is related to the lack of measures taken to eliminate CRLF sequences. Exploiting this vulnerability allows a remote attacker to alter account roles and gain administrator privileges...

CVE-2026-101145: Improper Neutralization of Special Elements used in an LDAP Query

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

PT-2026-102331

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software version 9.7.0 Description A flaw in the Play Audio Page component allows remote attackers to perform cross-site scripting XSS, which is a technique used to inject malicious scripts into web pages viewed by other...

CVE-2026-101141: Improper Neutralization of Input During Web Page Generation

A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manipulation of the argument viewRoleId/cfType can lead to cross site scripting. The attack can be launched remotely. The...

The vulnerability of the strcpy() function in the microprogramming software for UTT HiPER 810G allows a hacker to execute arbitrary code.

The vulnerability of the strcpy function in the microprogrammed routing software UTT HiPER 810G is related to the use of memory after deallocation when processing the loadBalanceNameOld parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the setLanguageCfg function (/cgi-bin/cstecgi.cgi) in the Totolink A8000R router’s microprogramming software allows a malicious individual to circumvent security restrictions and gain unauthorized access to read and modify data.

The vulnerability of the setLanguageCfg /cgi-bin/cstecgi.cgi function in the Totolink A8000R router’s microprogramming software is related to the lack of authentication for the critical langType parameter during processing. Exploiting this vulnerability allows an attacker to bypass security...

The vulnerability of the setWiFiBasicCfg() function in Totolink A8000RU router software allows a hacker to execute arbitrary commands.

The vulnerability of the setWiFiBasicCfg function in Totolink A8000RU router microprogramming software is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands using a...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...