CVE Vulnerability Catalog

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.

In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, the command `cmu.exe --create-io --file C:` creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.

The Push Notification for Post and BuddyPress plugin version 3.20 and earlier has a Subscriber Broken Access Control vulnerability. This means a user with the subscriber role can gain unauthorized access to functions they should not have permissions for.

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

Kali Forms version 2.4.23 and earlier has an Unauthenticated Broken Access Control vulnerability. This means an unauthenticated attacker can access functions that should be protected.

The Ditty plugin version 3.1.67 and earlier has a Subscriber Broken Access Control vulnerability. A user with the subscriber role can gain unauthorized access to functions they should not have permissions for.

Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

The FluentPlayer Pro plugin version 1.3.2 and earlier has an Editor Broken Access Control vulnerability. A user with the editor role can gain unauthorized access to functions they should not have permissions for.

Unauthenticated CSRF vulnerability in GeoDirectory plugin versions up to 2.8.176. An attacker can exploit CSRF to perform unwanted actions in the context of a logged-in administrator.

Subscriber sensitive data exposure vulnerability in SureFeedback Client Site versions up to 1.2.12. A user with subscriber role can access data they should not have permission to.

Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.

The Hash Form plugin versions up to 1.4.1 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

Unauthenticated XSS vulnerability in CozyStay versions up to 1.10.0. An attacker can inject malicious script that executes in the victim's browser.

The Beautiful Taxonomy Filters plugin versions up to 2.4.6 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.

The Geo Controller plugin versions up to 8.9.8 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

Subscriber SQL Injection vulnerability in Like Button Rating versions up to 2.6.61. A user with subscriber role can inject malicious SQL queries.

Unauthenticated XSS vulnerability in Music Player for WooCommerce versions up to 1.8.9. An attacker can inject malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in CP Media Player versions up to 1.3.0. An attacker can inject malicious script that executes in the victim's browser.

Editor PHP Object Injection vulnerability in Fluent Boards Pro versions up to 2.0.11. A user with editor role can inject malicious PHP objects, potentially leading to remote code execution.