CVE-2026-115904

A deserialization of untrusted data vulnerability in the Ultimate Member WordPress plugin allows Object Injection. Affects versions up to and including 2.13.1.

Wing FTP Server does not verify the user's base folder, allowing an attacker with admin privileges to add user directories via scripts that escape the base folder. This enables file writes on the system and potential remote code execution with process owner privileges, and with sudo-based installation files are created as root. Fixed in version 8.2.6.

HCL BigFix AEX is affected by a Remote Code Execution (RCE) vulnerability. An attacker may execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.

The Crowd Favorite DXP ToolKit plugin contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects DXP ToolKit versions from n/a through 2.0.1.

The Aman FunnelKit Automations (wp-marketing-automations) plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects FunnelKit Automations versions from n/a through 3.8.5.2.

The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. An authenticated attacker can execute arbitrary commands with www-data privileges. Fixed in version 2026061802.

The che-machine-exec service constructs a shell command by concatenating user-controlled input (username and namespace fields from /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c invocation without escaping. When authentication is disabled (default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec can access via shell command substitution.

The NoviGest Desktop App's Java RMI service lacks authentication in critical functions. An attacker with network access can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained to execute operating system commands on the server.

Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems.

Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems.