MAL-2026-18062 Malicious code in sc-wizard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 54691cc130e614ee031186f7e646c3e6076efad6105a6e9cad68f62aa736516b The OpenSSF Package Analysis project identified 'sc-wizard' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

CVE-2019-18655

CVE-2019-18655 metasploit module. SEH based buffer overflow in file sharing wizard app v.1.5.0. CVE summary: File Sharing Wizard version 1.5.0 is affected of Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution a...

CVE-2026-111650

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

EUVD-2026-103072

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

CVE-2026-111650 ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

CVE-2026-111650 ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

CVE-2026-111650

ChronoFrame versions through 1.0.0 are vulnerable to a missing authentication flaw in the server/api/wizard/ handlers. An unauthenticated attacker can exploit this by sending a POST request to /api/wizard/storage, enabling them to reconfigure existing instances. This allows for the activation of ...

CVE-2026-111650: Missing Authentication for Critical Function

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

PT-2026-116049

Name of the Vulnerable Software and Affected Versions ChronoFrame version 1.0.0 Description Missing authentication in the server/api/wizard/ handlers allows unauthenticated attackers to reconfigure already configured instances. By sending a POST request to the '/api/wizard/storage' endpoint, an...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-89116

The Yeoman-UI / Application Wizard Extension for VS Code is vulnerable to OS Command Injection (CWE-78). The issue stems from the use of child_process.execSync with a shell string during generator installation and uninstallation. Specifically, the ApplicationWizard.installationLocation workspace ...

CVE-2026-89195

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

EUVD-2026-96780

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89195

The Site Setup Wizard WordPress plugin, in versions up to and including 1.5.8 , is vulnerable to an unauthenticated SQL injection attack. The root cause is the improper sanitization and escaping of a parameter before its use in a SQL statement, specifically within the ssw_check_admin_email_exists...

CVE-2026-89195 Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

EUVD-2026-96739

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does n...

CVE-2026-104680

The Envira Gallery WordPress plugin versions prior to 1.16.2 is vulnerable to a privilege escalation flaw. The plugin fails to verify that a user possesses the specific capability reserved by WordPress for installing its code before processing a setup-wizard installation request. Additionally, it...

CVE-2026-104680 Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does n...

CVE-2026-89195: Improper Neutralization of Special Elements used in an SQL Command

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...