CVE-2025-67493
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Homarr prior to version 1.45.3 lacks sanitization of inputs in LDAP search queries, allowing privilege escalation and access to other users' groups. The vulnerability affects instances using LDAP authentication where an attacker has access to a user account. Version 1.45.3 patches the issue.
Risk Assessment
All instances using LDAP authentication are at risk if an attacker has access to any user account. This can lead to unauthorized access to other users' data and privileges.
Recommendation
Update Homarr to version 1.45.3 or later. If updating is not possible, consider restricting user account access or disabling LDAP authentication until the patch is applied.
Related vulnerabilities
- CVE-2026-87855Critical
The JTL-Connector plugin for WooCommerce up to version 2.4.3 is vulnerable to arbitrary file upload via the saveImage() function. This is due to accepting an empty jtlauth parameter as valid credentials and insufficient file type validation in handleImagePush(). This allows unauthenticated attackers to upload executable files, leading to remote code execution.
- CVE-2026-104800Critical
The AGE-GATE plugin for WordPress up to version 1.0 is vulnerable to remote code execution via the 'width' and 'height' parameters. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters into generated PHP source. This allows unauthenticated attackers to execute code on the server.
- CVE-2026-97668Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to SQL injection via the guest cart persistent meta_value. This is due to insufficient escaping and lack of prepared statements in the update_guest_persistent_cart() function. The abandoned_cart_info value is concatenated directly into an UPDATE statement, allowing unauthenticated attackers to append additional SQL, potentially leading to data extraction and privilege escalation.
- CVE-2026-97657Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to authentication bypass via malleable encryption and bypassable HMAC. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens and a conditional HMAC check that can be bypassed by omitting the wcap_nonce parameter. This allows unauthenticated attackers with a single legitimate link to forge ciphertext and take over any user's account, including administrators.
- CVE-2026-110447Critical
Collabora Online Built-in CODE Server before version 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, exploited in the wild in September and October 2026. This is an OS command injection in proxy.php when the CODE server isn't running. The vulnerability is not present in standalone Collabora Online servers.
- CVE-2026-110002Critical
The Snazzy Social Media Feed plugin for WordPress up to version 2.5 is vulnerable to arbitrary file upload via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter. This allows authenticated attackers with subscriber-level access and above to upload executable files, leading to remote code execution.
- CVE-2026-93388Critical
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce up to version 2.9.1 is vulnerable to unauthenticated arbitrary file upload leading to remote code execution. The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers, and its Google Drive branch rebuilds the destination filename from the raw gapi[name] parameter, bypassing the allow-list, and writes the fetched bytes to a web-accessible directory. This allows unauthenticated attackers to write a .php file to an executable location and execute arbitrary code on the server.
- CVE-2026-92097Critical
The Click to Chat for WhatsApp plugin for WordPress up to version 4.44 is vulnerable to arbitrary shortcode execution. This is due to the greetings_dialog() function building the {url} placeholder from a filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted content to do_shortcode() without stripping shortcode delimiters. This allows unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin.
- CVE-2026-110392Critical
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows OS Command Injection.
- CVE-2026-97381Critical
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
Original NVD description (English source)
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS