CVE-2026-101141: Improper Neutralization of Input During Web Page Generation

A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manipulation of the argument viewRoleId/cfType can lead to cross site scripting. The attack can be launched remotely. The...

CVE-2026-101144: Improper Access Control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

PT-2026-102331

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software version 9.7.0 Description A flaw in the Play Audio Page component allows remote attackers to perform cross-site scripting XSS, which is a technique used to inject malicious scripts into web pages viewed by other...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...

WordPress WebFacing Email Accounts for cPanel plugin 5.3-5.3.6 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by nobody in WordPress Plugin WebFacing Email Accounts for cPanel versions 5.3-5.3.6...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin 1.23.8-1.26.7 - Subscriber+ Remote Storage Credential Disclosure vulnerability

Subscriber+ Remote Storage Credential Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin UpdraftPlus versions 1.23.8-1.26.7...

CVE-2026-63431 Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)

Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated...

WordPress Elementor Website Builder plugin 4.3.0-4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Sakri Koskimies in WordPress Plugin Elementor Website Builder versions 4.3.0-4.3.1...

EUVD-2026-86500

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...

XWiki Platform - Remote Code Execution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document SkinsCode.XWikiSkinsSheet leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute...

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby...

Dahua IPC/VTH/VTO - Authentication Bypass

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. id: CVE-2021-33045 info: name: Dahua IPC/VTH/VTO - Authentication Bypass author: phantomowl severity:...

WordPress CSS & JavaScript Toolbox plugin <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin CSS & JavaScript Toolbox versions = 12.0.6...

WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin WooCommerce Product Table Lite versions = 5.6.7...

WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SEO Plugin by Squirrly SEO versions = 14.2.5...

WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tarcísio LuchesiPoystick in WordPress Plugin Profile Builder versions = 4.0.2...

WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Intrudify in WordPress Plugin GiveWP versions = 4.16.9...

WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...

WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Deva Parekh in WordPress Plugin Business Directory versions = 6.4.27...

WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Intrudify in WordPress Plugin NextGEN Gallery versions = 4.5.0...