CVE Vulnerability Catalog

The Brave Popup Builder plugin up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them, which can lead to Reflected XSS attacks.

The Content Mask WordPress plugin before version 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages without holding the publish capability.

The WooCommerce Bookings WordPress plugin before version 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.

The RestrictMate WordPress plugin before version 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.

A security flaw was discovered in Tenda CH22 1.0.0.1. The function formeditFileName in /goform/editFileName is vulnerable to command injection via the editNameMit argument. The attack can be launched remotely and the exploit has been released publicly.

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.

A vulnerability was found in SourceCodester Stock Management System 1.0. The file /php_action/getOrderReport.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack can be initiated remotely and the exploit has been made public.

A vulnerability has been found in SourceCodester Stock Management System 1.0. The file /php_action/printOrder.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack may be performed remotely and the exploit has been disclosed publicly.

A flaw has been found in sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The Management Mutation Handler is vulnerable to SQL injection via manipulation of roll_no/name/father_name/class/mobile/email/password/remark arguments. The attack can be carried out remotely. The exploit has been published and may be used. The project has not responded.

A vulnerability was detected in sambitraj Student-Management-System. Unknown functionality of the Dashboard component allows manipulation of roll_no/teacher_name arguments, leading to SQL injection. The attack can be executed remotely, and the exploit is now public.

A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIT2.php. Manipulation of the course argument leads to XSS. Remote exploitation is possible, and the exploit has been publicly disclosed.

chirpmyradio CHIRP before commit 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS1.php. Manipulation of the course argument leads to XSS. The attack can be launched remotely, and the exploit has been made public.

A vulnerability was found in alexta69 MeTube up to 2026.06.10. An unknown function in the file /download/.metube/cookies.txt of the Cookie File Handler component allows files or directories to be accessible. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 2026.06.20 resolves the issue.

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected function sub_41AD7C in /cgi-bin/mbox-config is vulnerable to stack-based buffer overflow via the timestr/ntp_client_enabled arguments. The attack can be launched remotely and the exploit has been made public.

This CVE has been rejected or withdrawn by its CVE Numbering Authority. No further information is available.

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.9.8 via the get_image_src_in_base64 function. This allows authenticated attackers with subscriber-level access or above to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints.

The Security Hardener plugin for WordPress up to version 2.4.4 is vulnerable to Missing Authorization. The default-enabled user-enumeration protection overwrites permission_callback on /wp/v2/users routes, stripping core capability checks. This allows authenticated attackers with Subscriber-level access to create Administrator accounts or reset existing Administrator passwords.

The PPWP – Password Protect Pages plugin for WordPress up to version 1.9.18 is vulnerable to PHP Object Injection via deserialization of untrusted input from the 'post_protection_roles' parameter. Authenticated attackers with Contributor-level access can inject a PHP Object. No known POP chain exists in the vulnerable software, but if another plugin or theme with a POP chain is installed, further attacks are possible.