Everyone’s AI MoAI-ADK backend link vulnerability

The All-Users AI MoAI-ADK 3.1.2 and earlier versions have a post-link vulnerability. This vulnerability stems from improper link resolution in the moai init template deployer. Attackers can use symbolic links to the.moai-tmp temporary path to overwrite files outside of the project, causing...

Leo open-computer-use: Input validation error vulnerability

Leo’s open-computer-use software versions 1.0.0 and earlier contain a vulnerability related to input validation. This vulnerability stems from improper handling of case sensitivity, which could allow local MCP callers to bypass the password manager’s rejection list by using case-variant bundle...

Hyper-MCP race condition issue

Hyper-MCP versions 0.8.3 and earlier have a vulnerability due to a race condition. This issue arises because the loadwasm function in src/wasm/oci.rs verifies the Cosign signature of individual tags, rather than the signature of the loaded manifests. An attacker can control the registry responses...

openagents-org openagents Authorization Issue Vulnerability

openagents-org has an authorization issue. This vulnerability stems from the lack of authentication for the GET /v1/workspaces interface, allowing unauthenticated attackers to list all workspaces. This may lead to the reading of sensitive information such as the unmasked browserfabricapikey, as...

Mina Saad pbi-cli command injection vulnerability

Mina Saad’s pbi-cli version 3.10.1 to 3.12.0 has a command injection vulnerability. This vulnerability stems from the use of desktopsync.py, which passes unquoted .pbip paths to the cmd /c start command. This makes it vulnerable to OS command injection attacks. An attacker can induce victims to...

WordPress Contact Form 7 has a vulnerability related to information leakage.

WordPress Contact Form 7 versions 5.0.7 and earlier have a vulnerability that leads to information leakage. This vulnerability occurs due to the exposure of sensitive data without authentication, which may result in the disclosure of sensitive information...

WordPress SpeedyCache information leakage vulnerability

WordPress SpeedyCache 1.4.2 and earlier versions have a vulnerability related to information leakage. This vulnerability arises from improper handling of the 'commentauthor' and 'commentauthoremail' parameters. The writing path lacks checks for the 'commentauthor' cookie, allowing malicious...

OpenLIT authorization issue vulnerabilities

OpenLIT 2.1.0 version has an authorization issue vulnerability. This vulnerability arises from bypassing authorizations by using a forged x-OpenLIT-project-id header. As a result, authenticated users may access telemetry data from other projects, including LLM prompts and completion content...

Mymoun Backhoe Code Injection Vulnerability

The Mymoun Backhoe 2.0 and earlier versions have a code injection vulnerability, which stems from unvalidated local file inclusion...

Helicone server request forgery vulnerability

Helicone v2025.08.21-1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the Jawn webhook sender’s server-side request forgeing feature, which allows authenticated organizational users to access internal services by accessing hostnames that poin...

WordPress Academy LMS has vulnerabilities related to permissions and access control systems.

WordPress Academy LMS versions 4.0.3 and earlier have vulnerabilities related to permission permissions and access control. These vulnerabilities arise from the addchild function, which calls addrole'academystudent' on existing accounts before Store::link verifies the guardianship relationship...

WordPress PayPal deserialization injection vulnerability

WordPress Payee versions 4.8.2 and earlier have a deserialization injection vulnerability. This vulnerability stems from unvalidated PHP object injections, which may lead to remote code execution...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.188 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the email parameter Contact Email custom field’s htmlvarname. It may lead to storage-based cross-site scripting attacks...

Mikado-Themes TouchUp Code Injection Vulnerability

Mikado-Themes versions prior to 1.4 have a code injection vulnerability. This vulnerability stems from unvalidated local file inclusions, which may allow attackers to access local files...

Themegoods DK authorization issue vulnerability

Themegoods DK 3.2.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from improper access control without authentication, which may allow attackers to modify data without proper authorization...

Themegoods Grand News Authorization Issue Vulnerability

Themegoods Grand News versions 3.4 and earlier have a vulnerability related to authorization issues. This vulnerability arises because unverified attackers can exploit improper access control mechanisms, allowing unauthorized modifications to data...

WordPress Booster for WooCommerce: Deserialization injection vulnerability

WordPress Booster for WooCommerce 8.4.0 and earlier versions have a deserialization injection vulnerability. This vulnerability allows unauthorized attackers to perform PHP object injections...

WordPress GeoDirectory code injection vulnerability

WordPress GeoDirectory 2.8.187 and earlier versions have a code injection vulnerability. This vulnerability stems from the designtype parameter, which involves local file inclusion. It may allow unauthenticated attackers to include and execute any.php file on the server, thereby bypassing access...

WordPress Booking System SQL Injection Vulnerability

The WordPress Booking System 2.1.0.1 and earlier versions have a SQL injection vulnerability. This vulnerability arises from insufficient escaping of the currentmonth parameter provided to users, as well as inadequate preparation of existing SQL queries. This leads to time-based SQL injections...

InnoShop input validation error vulnerability

InnoShop version 0.9.2 has a vulnerability in input validation. This vulnerability stems from improper handling of the source parameter in the AI Core MCP fileUpload tool. It allows authenticated administrators with the filescreate permission to use the file:// or php:// stream wrapper to read...

Nexcess Kadence Blocks: Cross-site Scripting Vulnerabilities

Nexcess Kadence Blocks versions 3.7.12 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping, leading to a stored-xss attack through the Block Font Family Attribute. Attackers with author-level or higher permissions ca...

WordPress Getwid Cross-Site Script Vulnerability

WordPress versions prior to 3.0.1 have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the data-image-points parameter input and inadequate escaping of output data. It may allow authenticated attackers with privileges of contributor or higher to inject...

Lulu AniWorld Downloader Authorization Issues Vulnerability

Lulu AniWorld Downloader versions prior to 5.3.0 have a vulnerability related to authorization. This vulnerability stems from the improper handling of authentication attempts by the /login POST handler in the WebUI. As a result, unauthorized attackers can enumerate usernames through the verifyuse...

tielabs jannah cross-site scripting vulnerabilities

Tielabs Jannah versions 7.6.5 and earlier have a cross-site scripting vulnerability. This vulnerability allows unauthenticated attackers to be exploited by cross-site scripting attacks...

WordPress Events Manager SQL Injection Vulnerability

WordPress Events Manager versions 7.4.6 and earlier have a SQL injection vulnerability. This vulnerability stems from SQL injections by subscribers and can lead to SQL injection attacks...

WordPress FunnelKit cross-site scripting vulnerability

WordPress FunnelKit 3.16.0.5 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. It is exploited through the shippingfirstname parameter, allowing for storage-based cross-site scripting attacks. This...

WordPress Noptin Cross-Site Script Vulnerability

WordPress Noptin 4.3.10 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping. Unauthenticated attackers can inject arbitrary web scripts using the 'noptinfields' parameter such as firstname, resulting in...

WordPress ACF Frontend Admin by DynamiApps: Cross-site Script Vulnerability

WordPress ACF Frontend Admin by DynamiApps version 3.28.36 and earlier has a cross-site scripting vulnerability. This vulnerability stems from the getdynamicvalues function’s text-level search and replacement operation on content, without proper HTML parsing. As a result, authenticated attackers...

Johann Heyne Table Field Add-on for ACF and SCF: Cross-site scripting vulnerabilities

The Johann Heyne Table Field Add-on for ACF and SCF versions 1.3.35 and earlier contains a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. Identified attackers with contributor-level or higher permissions can inject arbitrary...

Joomunited WP File Download Cross-Site Script Vulnerability

Joomunited WP File Download versions 6.3.6 and earlier have a cross-site scripting vulnerability, which is due to a vulnerability that can be exploited by cross-site scripting attacks...

WordPress WP Ultimate CSV Importer SQL Injection Vulnerability

WordPress WP Ultimate CSV Importer 9.2 and earlier versions have a SQL injection vulnerability, which can be exploited by SQL injection attacks...

WordPress Social Share Icons & Social Share Buttons Cross-site Script Vulnerabilities

WordPress Social Share Icons & Social Share Buttons versions 3.7.5 and earlier have a cross-site scripting vulnerability. This vulnerability allows unauthenticated attackers to perform cross-site scripting attacks...

SchlagmichDoch PairDrop Trust Management Vulnerability

Schlagmichdoch’s PairDrop version 1.11.2 and earlier have a trust management vulnerability. This vulnerability stems from an IP spoofing issue in Peer.setIP. A remote attacker can join discovery rooms on other networks by providing a specially crafted cf-connecting-ip header, thereby sending or...

WordPress rtMedia for WordPress, BuddyPress, and bbPress: Authorization issue vulnerabilities

WordPress rtMedia for WordPress, BuddyPress, and bbPress versions 4.7.13 and earlier have a licensing issue vulnerability. This vulnerability stems from insufficient file path validation in process functions, which may allow unauthenticated attackers to delete any security files on the server...

WordPress WPForms cross-site scripting vulnerabilities

WordPress WPForms 2.0.2.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper handling of parameters referenced by smart tags, particularly in the cleanup of attacker-controlled key inputs and output escaping. It may lead to reflective cross-site...

Keen IT Solutions Educavo Cross-site Scripting Vulnerabilities

Keen IT Solutions Educavo versions 3.4.2 and earlier have a cross-site scripting vulnerability, which stems from unvalidated cross-site scripting attacks...

WordPress ACF Frontend Admin by DynamiApps: SQL Injection Vulnerability

WordPress ACF Frontend Admin by DynamiApps version 3.29.13 and earlier has an SQL injection vulnerability. This vulnerability can be exploited by attackers with administrator privileges, allowing them to execute SQL injections and potentially lead to the disclosure of sensitive database informati...

OpenPanel input validation error vulnerability

OpenPanel 2.3.0 and earlier versions have a vulnerability related to input validation errors. This vulnerability stems from CSV formula injections. Unverified attackers can exploit this flaw by providing a custom profile ID as part of the /track endpoint, allowing them to inject spreadsheet...

WordPress Payment Processing via MetaMask for WooCommerce: Input Validation Vulnerability

WordPress payments via MetaMask for WooCommerce versions 1.7.2 and earlier have a vulnerability related to input validation errors. This vulnerability stems from unvalidated bypass attempts...

WordPress Filter Everything Cross-Site Script Vulnerabilities

WordPress Filter Everything 1.9.6 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from the flrtelementorloadmoreanchor function’s insufficient input sanitization and output escaping. The function does not escape the URL retrieved from $SERVER'REQUESTURI' a...

WordPress JetFormBuilder cross-site scripting vulnerabilities

WordPress JetFormBuilder 3.6.6 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of query variable name parameters that match the preset queryVar settings, as well as inadequate output escaping. This can lead to reflective DOM...

WordPress Advanced IP Blocker authorization issue vulnerability

WordPress Advanced IP Blocker versions 8.13.13 and earlier have a licensing issue vulnerability. This vulnerability stems from the handleloginaction function, which processes the second-step TOTP submission without verifying that the requester has completed the first step of password authenticati...

WordPress Brizy Cross-Site Script Vulnerability

WordPress Brizy 2.8.18 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. When the ‘brizy-compiled-sections’ parameter is used, it may lead to stored-cross-site scripting attacks. Certified attackers...

WordPress Fastcache by Host.it: Code injection vulnerability

WordPress Fastcache by Host.it 1.7.4 and earlier versions have a code injection vulnerability. This vulnerability arises from the lack of cleanup when registering settings using the fastcachesettingscachecookieexclude parameter. Additionally, buildSiteHtaccessRules only uses trim to process cooki...

WordPress ai-copilot-content-generator: Permissions, licensing, and access control issues

WordPress ai-copilot-content-generator versions 1.5.9 and earlier have vulnerabilities related to permission escalation and access control. These vulnerabilities stem from issues with permission elevation, which may allow subscribers to elevate their own permissions...

Qode Real Estate cross-site scripting vulnerability

Qode Real Estate versions 1.1.7.3 and earlier have a cross-site scripting vulnerability, which stems from unauthenticated cross-site scripting attacks...

NetEase Youdao LobsterAI has a vulnerability regarding input validation.

From the version of NetEase Youdao LobsterAI on April 23, 2026, to April 23, 2026.5.27, there is a vulnerability in input validation. This vulnerability stems from the skills:delete IPC handler, which trusts the openclawSourceDir value from the skills.meta.json file during the uninstall process...

John Broadway Pacioli authorization issue vulnerability

In versions of John Broadway Pacioli from 0.9.6 to 0.10.0, there is an authorization issue vulnerability. This vulnerability stems from the Pacioli-Guard documentation layer not checking whether the consent marker has been authorized for cancellation. This allows nested cancellation operations to...

Himovo MOVO authorization issue vulnerability

The Himovo MOVO versions 0.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass in the chat-api documentation endpoints. It allows authenticated users to access objects stored by other users by providing arbitrary object paths. Attackers...

Hayat Health Facilities Hayat Mobile Authorization Issue Vulnerability

Hayat Health Facilities Hayat Mobile versions 3.3.0 to 3.4.0 had an authorization issue vulnerability. This vulnerability stemmed from the use of client authentication, which could lead to authentication bypasses...