CVE-2026-1945

The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpbusername' and 'wpbuseremail' parameters in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-22858

The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb user name' and 'wpb user email' parameters in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2025-67977

Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through = 1.0.8...

CVE-2025-67977 WordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through = 1.0.8...

CVE-2026-2112 Dam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion

The Dam Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce verification on the pending comment deletion action in the cleanup page. This makes it possible for unauthenticated attackers to delete all pendi...

Microweber 1.0.8 Reflected Cross Site Scripting

A reflected cross site scripting vulnerability exists in Microweber CMS version 1.0.8. The vulnerability allows remote attackers to inject arbitrary web script or HTML. This issue is older research added to the archive...

dooblou WiFi File Transfer 跨站脚本漏洞

Dooblou WiFi File Transfer is a file transfer application developed by the dooblou company. Version 1.0.8 of Dooblou WiFi File Transfer contains a cross-site scripting vulnerability. This vulnerability stems from the use of file and folder names that contain storage-type cross-site scripts,...

CVE-2026-25047

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8...

deepHas vulnerable to Prototype Pollution via constructor.prototype

Summary A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8. Details The vulnerability resides in the add function and indexer function implemented within deepHas.js...

GHSA-2733-6C58-PF27 deepHas vulnerable to Prototype Pollution via constructor.prototype

Summary A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8. Details The vulnerability resides in the add function and indexer function implemented within deepHas.js...

CVE-2026-25047 deepHas vulnerable to Prototype Pollution via constructor.prototype

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8...

CVE-2026-25047

CVE-2026-25047 affects the deephas npm package, specifically version 1.0.7, which contains a prototype pollution vulnerability in its handling of nested object keys. The issue allows an attacker to modify global object behavior (e.g., via constructor.prototype.polluted or proto .polluted) and can...

CVE-2026-25047 deepHas vulnerable to Prototype Pollution via constructor.prototype

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8...

EUVD-2026-4946

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8...

CVE-2026-25047 deepHas vulnerable to Prototype Pollution via constructor.prototype

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8...

CVE-2026-25047

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8...

PT-2026-5362

Name of the Vulnerable Software and Affected Versions deephas version 1.0.7 deephas versions prior to 1.0.8 Description A prototype pollution issue exists in the deephas npm package. This allows an attacker to modify global object behavior by injecting properties into Object.prototype. The issue...

WordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin HAPPY versions = 1.0.8...

CVE-2026-24399 ChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Execution

ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an payload containing a javascript: URI can be processed and executed in the browser context. This allow...

CVE-2026-24399

ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an payload containing a javascript: URI can be processed and executed in the browser context. This allow...