WordPress HAPPY plugin missing authorization vulnerability

WordPress HAPPY plugin is a feature extension plugin for Elementor page builder. A lack of authorization vulnerability exists in WordPress HAPPY plugin, which can be exploited by an attacker to cause the exploitation of a misconfigured access control security level...

WordPress User Feedback plugin SQL Injection Vulnerability

WordPress User Feedback plugin is a tool designed for WordPress websites to create and manage user feedback forms, surveys and contact forms. WordPress User Feedback plugin suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL...

WordPress Astra Widgets plugin cross-site scripting vulnerability

WordPress Astra Widgets plugin is a widgets extension plugin developed by the Astra Themes team to enhance the functionality of Astra themes. WordPress Astra Widgets plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping...

WordPress Gift Hunt plugin cross-site scripting vulnerability

WordPress Gift Hunt plugin is a plugin for creating interactive scavenger hunts on WordPress websites. The WordPress Gift Hunt plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be...

WordPress PowerPack Pro for Elementor plugin missing license vulnerability

WordPress PowerPack Pro for Elementor plugin is an Elementor page builder extension plugin designed for the WordPress platform. A lack of authorization vulnerability exists in WordPress PowerPack Pro for Elementor plugin, which can be exploited by an attacker to leverage a misconfigured access...

WordPress Brave plugin missing authorization vulnerability

WordPress Brave plugin by Brave Software develops Brave Browser Extensions for WordPress integration. A lack of authorization vulnerability exists in the WordPress Brave plugin, which can be exploited by an attacker to cause the exploitation of a misconfigured access control security level...

WordPress Evergreen Post Tweeter plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Evergreen Post Tweeter plugin suffers from a cross-site request forgery vulnerability that stems from the application's lack of effective filtering and escaping of...

WordPress Nika plugin file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress Nika plugin that stems from not doing effective filtering of local file resource calls, which can be exploited by an...

WordPress H5P plugin missing authorization vulnerability

WordPress H5P plugin is an open source plugin that allows users to create, manage and embed interactive multimedia content in WordPress websites. A lack of authorization vulnerability exists in WordPress H5P plugin, which can be exploited by an attacker to cause the exploitation of misconfigured...

WordPress Diza plugin file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress Diza plugin that stems from not doing effective filtering of local file resource calls, which can be exploited by an...

Command Execution Vulnerability in RG-EST350 V2 of Beijing StarNet Ruijie Network Technology Co.

Ruijie EST350-V2 is a wireless outdoor bridge product supporting 802.11ac protocol, which is designed for the business of video transmission or data transmission in the scenarios of tower crane, factory, scenic spot, park, planting base, fishpond aquaculture base, construction site, etc. Ruijie...

WordPress WC Builder Cross-Site Scripting Vulnerability

WordPress WC Builder is a WooCommerce page builder designed for WordPress websites. A cross-site scripting vulnerability exists in WordPress WC Builder that stems from improper input neutralization during page generation, and no detailed vulnerability details are provided at this time...

CMSimple cross-site scripting vulnerability (CNVD-2026-0082457)

CMSimple is a free content management system. CMSimple suffers from a cross-site scripting vulnerability that stems from the Filebrowser external input field not properly filtering or encoding user-supplied content for output. An attacker can exploit the vulnerability by constructing malicious...

UTT aggressive 512W buffer overflow vulnerability (CNVD-2026-0079277)

The UTT Progressive 512W is an enterprise-grade wireless router from Atech UTT designed for small and medium-sized businesses SOHO and similarly sized network environments for access scenarios of 30 to 50 users. UTT Progressive 512W suffers from a buffer overflow vulnerability that originates fro...

Orangescrum Cross-Site Scripting Vulnerability

Orangescrum is a project and task management software tool that also provides productivity tools for work organization and team collaboration. A cross-site scripting vulnerability exists in Orangescrum, which stems from insufficient validation of parameter inputs such as projid, CSmessage, and...

IBM Concert Heap Memory Cleaning Improperly Vulnerability

IBM Concert is a generative artificial intelligence-driven automated application management and monitoring tool based on the watsonx platform, announced by IBM in May 2024 at the IBMThink conference in Boston, USA. IBM Concert suffers from an improper heap memory cleanup vulnerability that can be...

NVIDIA Isaac Launchable Trust Management Issue Vulnerability

NVIDIA Isaac Launchable is a one-click deployment GPU development environment designed to simplify the AI development process and accelerate experimentation and deployment. NVIDIA Isaac Launchable suffers from a trust management issue vulnerability that stems from improperly protected credentials...

CMSimple_XH Code Execution Vulnerability

CMSimpleXH is a PHP-based content management system derived from the original CMSimple project and belongs to its offshoot version. CMSimpleXH suffers from a code execution vulnerability that stems from the content editing functionality not securely restricting or filtering code input when...

CMSimple Code Execution Vulnerability

CMSimple is a free content management system. CMSimple suffers from a code execution vulnerability that stems from the template editing feature not securely controlling and filtering the content of user-inputted code, resulting in logged-in users being able to inject malicious PHP code into...

UTT aggressive 512W buffer overflow vulnerability (CNVD-2026-0079375)

The UTT Progressive 512W is an enterprise-grade wireless router from Atech UTT designed for small and medium-sized businesses SOHO and similarly sized network environments for access scenarios of 30 to 50 users. UTT Progressive 512W suffers from a buffer overflow vulnerability that originates fro...

Orangescrum Elevation of Privilege Vulnerability

Orangescrum is a project and task management software tool that also provides productivity tools for work organization and team collaboration. Orangescrum suffers from an elevation of privilege vulnerability, which stems from the application's failure to effectively verify the source of requests ...

CMSimple Cross-Site Scripting Vulnerability

CMSimple is a free content management system. CMSimple suffers from a cross-site scripting vulnerability that stems from the application not effectively filtering or neutralizing HTML Unicode encoding when processing user input. An attacker could use this vulnerability to execute arbitrary...

Orangescrum SQL Injection Vulnerability

Orangescrum is a project and task management software tool that also provides productivity tools for work organization and team collaboration. Orangescrum suffers from a SQL injection vulnerability that stems from insufficient validation of parameter inputs such as oldprojectid, projectid, uuid,...

UTT aggressive 512W buffer overflow vulnerability (CNVD-2026-0079178)

The UTT Progressive 512W is an enterprise-grade wireless router from Atech UTT designed for small and medium-sized businesses SOHO and similarly sized network environments for access scenarios of 30 to 50 users. The UTT Progressive 512W suffers from a buffer overflow vulnerability that originates...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Shenzhou Vision Han Technology Co., Ltd (CNVD-C-2025-1206330)

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

NVIDIA Isaac Launchable Arbitrary Code Execution Vulnerability

NVIDIA Isaac Launchable is a one-click deployment GPU development environment designed to simplify the AI development process and accelerate experimentation and deployment. NVIDIA Isaac Launchable suffers from a security vulnerability that stems from improper design and can be exploited by remote...

CMSimple File Inclusion Vulnerability

CMSimple is a free content management system. CMSimple suffers from a file inclusion vulnerability that stems from improper handling of template/function include paths, which allows the application to include local files without securely restricting and validating the file paths. An attacker can...

UTT Progressive 512W Buffer Overflow Vulnerability

The UTT Progress 512W is an enterprise-grade wireless router designed for small office or home office SOHO environments for network scenarios with up to 50 people. The UTT Progressive 512W suffers from a buffer overflow vulnerability that originates from the incorrect operation of the strcpy...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Shenzhou Vision Han Technology Co., Ltd (CNVD-C-2025-1203509)

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

WordPress WpStream Missing Authorization Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A lack of authorization vulnerability exists in WordPress WpStream, which can be exploited by an attacker to leverage a misconfigured access control security level...

WordPress Spiffy Calendar Missing Authorization Vulnerability

WordPress Spiffy Calendar is a WordPress calendar plugin focused on helping users manage and display events. A lack of authorization vulnerability exists in WordPress Spiffy Calendar, which can be exploited by an attacker to leverage a misconfigured access control security level...

WordPress Category Icon Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Category Icon, which stems from improper input neutralization during page generation; no detailed vulnerability details...

WordPress Vimeotheque Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress Vimeotheque suffers from a cross-site request forgery vulnerability for which no detailed vulnerability details are currently available...

WordPress Funnelforms Free Missing License Vulnerability

Funnelforms Free is a free plugin that focuses on helping webmasters increase conversions through multi-step forms and contact forms. WordPress Funnelforms Free suffers from a lack of authorization vulnerability, which can be exploited by an attacker to perform an unauthorized operation via a...

WordPress My auctions allegro cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress My auctions allegro, which stems from improper input neutralization, and no detailed vulnerability details are provided ...

WordPress Fast User Switching Cross-Site Request Forgery Vulnerability

Fast User Switching is a plugin that allows site administrators to quickly switch between different user accounts, operating directly from the WordPress admin toolbar. WordPress Fast User Switching suffers from a cross-site request forgery vulnerability, and no details of the vulnerability are...

WordPress Plugin VikBooking Hotel Booking Engine & PMS Information Disclosure Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin VikBooking Hotel Booking...

ChurchCRM Cross-Site Scripting Vulnerability

ChurchCRM is an open source church management system. ChurchCRM suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data on the View Active People, View Inactive People, and View All People pages, which can be exploited b...

Kentico Xperience cross-site scripting vulnerability (CNVD-2026-05124)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject malicious script via an error message containing a specially crafted object name...

ChurchCRM Cross-Site Scripting Vulnerability (CNVD-2026-0536090)

ChurchCRM is an open source church management system. ChurchCRM suffers from a cross-site scripting vulnerability that originates from a low-privileged user being able to inject persistent JavaScript into group role names, which can be exploited by an attacker to cause an account takeover...

RiteCMS Cross-Site Request Forgery Vulnerability

RiteCMS is an open source content management system based on php and sqlite. RiteCMS has a cross-site request forgery vulnerability, the vulnerability stems from the page creation and editing functions do not adequately verify whether the request comes from a trusted user, an attacker can use thi...

ChurchCRM Privilege Elevation Vulnerability

ChurchCRM is an open source CRM system for churches. ChurchCRM suffers from an elevation of privilege vulnerability that stems from the application not properly implementing an access control mechanism that directly references data transmitted from the client as an object, no details of the...

ChurchCRM Information Disclosure Vulnerability

ChurchCRM is an open source church management system. ChurchCRM suffers from an information disclosure vulnerability that originates from the disclosure of database information in an error message, which can be exploited by an attacker to cause the disclosure of database information, including...

Unspecified vulnerability in Kentico Xperience (CNVD-2026-04263)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience has a security vulnerability that can be exploited by an attacker to cause sensitive information to be exposed to an external domain...

Student File Management System login_query.php File SQL Injection Vulnerability

Student File Management System is a student file management system. The Student File Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter Username in the file /admin/loginquery.php. An...

Apple macOS Information Disclosure Vulnerability (CNVD-2026-16059)

Apple macOS is an operating system from the American company Apple Apple. Apple macOS has an information disclosure vulnerability that can be exploited by attackers to cause access to sensitive user data...

Student File Management System /delete_student.php File SQL Injection Vulnerability

Student File Management System is a student file management system. The Student File Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter studentid in the file /admin/deletestudent.php. An...

WordPress Plugin Restaurant Menu by MotoPress Information Disclosure Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin Restaurant Menu by...

RiteCMS Cross-Site Scripting Vulnerability

RiteCMS is an open source content management system based on php and sqlite. RiteCMS suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute arbitrary Web...

Apache Fineract Information Disclosure Vulnerability (CNVD-2026-00006)

Apache Fineract is a set of open source digital financial services platform from the U.S. Apache Apache Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. Apache Fineract suffers from an...