WordPress Formidable Digital Signatures file deletion vulnerability

WordPress Formidable Digital Signatures is a paid extension for the Formidable Forms plugin, allowing for the embedding of drawable electronic signature fields within WordPress forms. It enables the saving of handwritten signatures as images and their association with submission data. There is a...

WordPress Ajax Search Lite PHP Object Injection Vulnerability

WordPress Ajax Search Lite is a free WordPress plugin developed by wpdreams. It provides a real-time search experience where results are displayed immediately upon input. This plugin can replace the default search function and supports customization of content types and fields. However, WordPress...

WordPress AI ANN PHP Object Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress AI ANN suffers from a PHP object injection vulnerability. This vulnerability stems from improper handling of user input by the deserialization module, allowing attackers to inject...

WordPress FluentSMTP cross-site scripting vulnerability

WordPress FluentSMTP is a fully free and powerful WordPress plugin designed to take over the default email sending mechanism wpmail. By configuring an external SMTP service, it improves the email delivery rate, and it supports multiple SMTP connection routes, such as distinguishing between...

WordPress Custom CSS and JavaScript data leakage vulnerabilities

WordPress Custom CSS and JavaScript allow for the addition of custom styles and interactive scripts through backend or plugins, without modifying the core theme files. This enables fine-tuning of the interface and expansion of functionality. However, WordPress Custom CSS and JavaScript have a dat...

WordPress: A Williams PHP Object Injection Vulnerability

WordPress A Williams is a commercial WordPress theme designed for secretaries, personal assistants, administrative staff, and consulting companies. WordPress A Williams has a PHP object injection vulnerability, which stems from improper deserialization of untrusted data, allowing for PHP object...

LiteLLM SQL injection vulnerability

LiteLLM is an open-source application developed by Berri AI. It allows for the invocation of all LLM APIs in the OpenAI format. LiteLLM has a SQL injection vulnerability, and attackers can exploit this vulnerability to obtain sensitive database information...

WordPress 69: PHP Object Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress 69 Clothing has a PHP object injection vulnerability, which stems from the lack of security checks on deserialized data by the program. Attackers can exploit this vulnerability to...

The WordPress E2Pdf file contains a vulnerability

WordPress E2Pdf is a plugin designed specifically for WordPress. Its core functionality involves creating and editing PDF documents and forms directly from the site backend. It also supports automatically converting post, page, or form content into dynamic/static PDF outputs. WordPress E2Pdf has ...

WordPress EONSR AEO Agent Cross-Site Script Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. The WordPress EONSR AEO Agent has a cross-site scripting vulnerability. This vulnerability stems from the lack of authorization checks in the REST API routing, and HTML content cleaning is...

WordPress CAPTCHA: A vulnerability in 4WP that allows bypassing verification

WordPress CAPTCHA 4WP is a paid verification plugin designed specifically for WordPress. It integrates third-party services such as Google reCAPTCHA, hCaptcha, and Cloudflare Turnstile to prevent robot attacks, spam comments, fake registrations, and automated login attempts. WordPress CAPTCHA 4WP...

WordPress AI Engine Cross-Site Script Vulnerability

WordPress AI Engine is an official WordPress plugin developed by developer JordyMeow. It aims to seamlessly integrate mainstream large language models such as OpenAI, Anthropic, and Google into the WordPress backend, providing core features like chatbots, content generation, AI forms, and...

WordPress Forminator cross-site scripting vulnerability

WordPress Forminator is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Forminator has a cross-site scripting vulnerability. This vulnerability arises from ForminatorCore::sanitizearray, which skips fields starting with “select”, and setfieldda...

WordPress Creative Mail SQL Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Creative Mail has a SQL injection vulnerability, which stems from improper handling of special elements in SQL commands. Attackers can exploit this vulnerability to obtain sensitive...

WordPress WP Statistics information leakage vulnerability

WordPress WP Statistics is a free and open-source content management system CMS and blog platform built using PHP/MySQL. WordPress WP Statistics has a vulnerability known as information leakage, which stems from the lack of a capability check in the AJAX handler for dashboard analysis. It relies...

D-Link DWR-M961 buffer overflow vulnerability

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a buffer overflow vulnerability. This vulnerability stems from the app.cgi interface not properly restrictin...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32359)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability, which stems from the app.cgi interface not filtering the command separato...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32366)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability arises from the fact that the /boafrm/formUSSDSet...

WordPress YMC Filter cross-site scripting vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. The WordPress YMC Filter has a cross-site scripting vulnerability. This vulnerability stems from the lack of object ownership verification during the saving of layout builders, as well as the...

WordPress WP Events Manager has a vulnerability related to insufficient validation of data authenticity.

WordPress WP Events Manager is a WordPress plugin used for creating, managing, and displaying events such as meetings, courses, and performances. It supports calendar views, registration, ticket sales, and integration with location maps. There is a vulnerability in WordPress WP Events Manager...

WordPress Subscriptions for WooCommerce: Insufficient Data Integrity Verification Vulnerability

WordPress Subscriptions for WooCommerce is the official paid extension of WooCommerce, known as "WooCommerceSubscriptions" a core subscription solution. WordPress Subscriptions for WooCommerce has a vulnerability related to data authenticity verification. This vulnerability arises from the fact...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32364)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability stems from the fact that the /boafrm/formSmsManager...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32361)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability, which stems from the /boafrm/formNtp interface not filtering the command...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32365)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability stems from the /boafrm/formDebugDiagnostics interface...

WordPress ShareOpenly Cross-Site Script Vulnerability

WordPress ShareOpenly is an open-source social sharing plugin designed specifically for WordPress. It aims to replace outdated traditional sharing buttons. WordPress ShareOpenly has a cross-site scripting vulnerability, which stems from the $url variable in the sharing link being output before th...

WordPress Simple CAPTCHA with Cloudflare Turnstile: Insufficient data authenticity verification vulnerabilities

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Simple CAPTCHA with Cloudflare Turnstile has a vulnerability related to insufficient data authenticity verification. This vulnerability stems from the Turnstile validation cache in th...

WordPress Download Monitor has an authorization vulnerability

WordPress Download Monitor is a powerful free plugin designed specifically for WordPress, used to manage, track, and analyze website file downloads. It supports version control, permission restrictions, and detailed logging. WordPress Download Monitor has an authorization vulnerability that arise...

WordPress AI Engine path traversal vulnerability

WordPress AI Engine is a core component of the official WordPress plugin library developed by developer JordyMeow. Its purpose is to integrate multi-model AI capabilities chatbots, content generation, MCP smart agents, etc. natively into the WordPress backend, allowing for easy invocation of...

D-Link DWR-M961 has a command injection vulnerability

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability arises from the fact that the /boafrm/formWSC interfa...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32360)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability arises from the fact that the...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32363)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability, which stems from the /boafrm/formPinManager interface not filtering the...

WordPress AI Engine authorization bypass vulnerability

WordPress AI Engine is a core component of the official WordPress plugin library developed by developer JordyMeow. Its purpose is to integrate multi-model AI capabilities chatbots, content generation, MCP smart agents, etc. directly into the WordPress backend, allowing for easy invocation of...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32362)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability stems from the /boafrm/formIMEISetup interface not...

IBM Langflow OSS Authentication Bypass Vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a vulnerability related to authentication bypass. This vulnerability arises when the MCP Composer endpoint is set to mcpcomposerEnabled=true default value and the project...

IBM Langflow OSS Code Execution Vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from the use of truncated SHA-256 hashes for code verification by the custom component validation mechanism. The hashi...

IBM Langflow OSS path traversal vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a path traversal vulnerability. This vulnerability arises from the use of user-provided knowledge base names directly for creating file paths. Without proper cleaning or check...

IBM Langflow OSS Code Execution Vulnerability (CNVD-2026-32369)

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from the failure to properly handle components generated by the LLM during the Agentic Assistant validation process. T...

IBM Langflow OSS code injection vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code injection vulnerability. This vulnerability arises from improper handling of user input code, resulting in inadequate control over inputs. Attackers can exploit this...

IBM Langflow OSS authorization bypass vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a vulnerability related to authorization bypass. This vulnerability arises from the fact that the retrievemessages and storemessage methods of MemoryComponent only filter...

IBM Langflow OSS weak encryption key derivation vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a weak encryption key derivation vulnerability. This vulnerability stems from the ensurefernetkey function not properly handling the key derivation process, resulting in...

IBM Langflow OSS path traversal vulnerability (CNVD-2026-32376)

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a path traversal vulnerability. This vulnerability arises from failing to properly validate URL-encoded path traversal sequences in file names when handling MCP resources/read...

IBM Langflow OSS arbitrary directory deletion vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a vulnerability related to arbitrary directory deletion. This vulnerability stems from its failure to properly validate the username field. Attackers can exploit this...

IBM Langflow OSS Code Execution Vulnerability (CNVD-2026-32373)

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from improper handling of HTTP requests, allowing attackers to execute arbitrary code on the server by exploiting this...

N-able N-central authorization issue vulnerability

N-able N-central is a remote monitoring and management system developed by the Canadian company N-able. Versions of N-able N-central prior to 2026.1 contained security vulnerabilities. Attackers could exploit these vulnerabilities to bypass authentication processes...

IBM Langflow OSS code injection vulnerability

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

IBM App Connect Enterprise information leakage vulnerability (CNVD-2026-31544)

IBM App Connect Enterprise is an enterprise-level application connection platform used for system integration. It supports connections and conversions between applications, data, and APIs. There is an information leakage vulnerability in IBM App Connect Enterprise. This vulnerability stems from t...

IBM Langflow OSS path traversal vulnerability

IBM Langflow OSS is an open-source low-code visual AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to integrate wit...

IBM Langflow OSS command injection vulnerability

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications through drag-and-drop components. Additionally, it supports deep customization using Python to integrate...

IBM Langflow OSS authorization issue vulnerability (CNVD-2026-31200)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

IBM DataPower Gateway Denial-of-Service Vulnerability (CNVD-2026-31545)

IBM DataPower Gateway is an enterprise-level data integration and security gateway product that provides features such as API management, message routing, and protocol conversion. There is a denial-of-service vulnerability in IBM DataPower Gateway. This vulnerability stems from improper resource...