CVE Vulnerability Catalog

MyBB before version 1.8.40 in the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar.

Prior to version 1.8.40, the calendar module in MyBB does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. This issue is fixed in version 1.8.40.

Prior to version 1.8.40, the calendar module in MyBB does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.

Prior to version 1.8.40, the Admin CP UTF-8 Conversion module in MyBB does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. This issue is fixed in version 1.8.40.

MyBB before version 1.8.40 contains a vulnerability in the Contact module that does not properly validate redirect URLs, leading to open redirect and reflected JavaScript code injection.

MyBB from version 1.8.13 to 1.8.40 contains a vulnerability in the installer module that improperly escapes database configuration values, leading to PHP code injection and remote code execution.

MyBB before version 1.8.40 has a stored JavaScript code injection vulnerability in checkbox and multiselect profile field types. Profile field validation does not properly handle non-array values, allowing malicious code to be stored and rendered without processing by the MyCode parser.

MyBB before version 1.8.40 has a JavaScript code injection vulnerability in the Buddy/Ignore component due to improper username sanitization. Specially crafted usernames can leave unescaped single quotes, which can be exploited to execute scripts.

CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.

The Entries component in Brainstorm Force SureForms versions less than 2.12.3 does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, allowing a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.

The HTTPPasswordMgr class in the urllib.request module and its subclasses did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for https:// were also used for http:// requests, allowing cleartext capture.

AAP Controller's HashiCorp Vault credential plugin contains a vulnerability that sends the Kubernetes service account token to an attacker-controlled URL when testing Vault credentials with kubernetes_role authentication.

RAGFlow before version 0.26.3 has a server-side request forgery vulnerability in the agent workflow Invoke component. The component builds an outbound request URL from canvas configuration and template variables and passes it to requests.get/post/put without safety validation, allowing access to internal network resources.

This CVE ID has been rejected as a duplicate of CVE-2026-50236. It was reserved in error for a finding that already had an existing CVE assignment.

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email.

TRENDnet TEW-WLC100 version 1v2.07b01 contains a stack-based buffer overflow vulnerability in the function FUN_0040da4c in /usr/nginx/sbin/nginx, in the HTTP Header Handler component. Manipulation of the Server argument can lead to remote attacks.

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

Unauthenticated SQL Injection vulnerability in Readabler plugin versions before 2.0.18. An attacker without authentication can inject SQL queries.

A vulnerability in TaxoPress (up to version 3.51.0) involves deserialization of untrusted data, allowing Object Injection.

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.