Vitepos-CVE-Report

Vitepos-CVE-Report إفصاح عن CVE-2025-13156 CVE-2025-13156 - ثغرة في Vitepos – Point of Sale POS for WooCommerce يستعرض هذا المستودع ثغرة تم اكتشافها في Vitepos – Point of Sale POS for WooCommerce =' \ -H 'X-WP-Nonce: ' \ -F 'categoryname=evil' \ -F 'categoryparent=0' \ -F...

CVE-2026-105076

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...

CVE-2026-105076

The Appsbd Vitepos vitepos-lite WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 3.6.1 . The root cause is the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). This flaw allows an attacker to perform unauthorized database queries. N...

EUVD-2026-94942

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...

CVE-2026-105076 WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...

WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin Vitepos versions = 3.6.1...

CVE-2026-96815

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

CVE-2026-96815

The Vitepos plugin for WordPress (versions

CVE-2026-96815 WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

CVE-2026-96815 WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

EUVD-2026-89868

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

CVE-2026-96815: Incorrect Privilege Assignment

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

PT-2026-103200

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Vitepos versions = 3.5.0...

WordPress Vitepos Lite plugin < 3.5.0 - Outlet Manager+ Privilege Escalation vulnerability

Outlet Manager+ Privilege Escalation vulnerability discovered by RealKingEngine ISAL FRAMEWORK in WordPress Plugin Vitepos versions 3.6.0...

WordPress Vitepos plugin < 3.6.0 - Outlet Manager+ Privilege Escalation vulnerability

Outlet Manager+ Privilege Escalation vulnerability discovered by RealKingEngine ISAL FRAMEWORK in WordPress Plugin Vitepos versions 3.6.0...

CVE-2026-14238

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

CVE-2026-14237

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

CVE-2026-14238 Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

EUVD-2026-54993

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...