CVE Vulnerability Catalog

CVE-2026-42753 describes a missing authorization vulnerability in the WC Lovers WCFM Membership plugin, allowing exploitation of incorrectly configured access control security levels. This issue affects WCFM Membership from n/a through version 2.11.10.

CVE-2026-42749 describes an authentication bypass vulnerability in the Themeisle Disable Comments for Any Post Types (Remove comments) plugin, allowing password recovery exploitation. This issue affects versions from n/a through 1.3.0.

The vulnerability in ZAYTECH Smart Online Order for Clover allows the leakage of sensitive data by embedding it in sent data. This issue affects versions from n/a through 1.6.0 inclusive.

CVE-2026-42745 describes an authentication bypass vulnerability in ZAYTECH Smart Online Order for Clover. This issue affects versions from n/a through 1.6.0 inclusive.

CVE-2026-42739 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in the Advanced IP Blocker application. This issue affects versions from n/a through 8.10.7.

CVE-2026-42738 describes an improper neutralization of input during web page generation, leading to Stored XSS vulnerabilities in the ZAYTECH Smart Online Order for Clover application. This issue affects versions from n/a through 1.6.0.

CVE-2026-42737 describes an improper limitation of a pathname to a restricted directory, leading to a Path Traversal vulnerability in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.

CVE-2026-42736 describes an authorization bypass vulnerability through a user-controlled key in the BP Better Messages plugin. This issue affects versions from n/a through 2.14.16 inclusive.

An authentication bypass vulnerability in the KiviCare clinic management system allows for password recovery exploitation. This issue affects KiviCare from n/a through version 4.3.0.

CVE-2026-42734 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in Geo Mashup. The issue affects versions from n/a through 1.13.19.

CVE-2026-42733 describes an improper neutralization of input during web page generation in the WPCS currency-switcher plugin, leading to DOM-Based XSS attacks. This issue affects WPCS from n/a through version 1.3.1.

The MasterStudy LMS has a Blind SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions from n/a through 3.7.29.

CVE-2026-42729 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in the Property Hive application. This issue affects versions from n/a through 2.2.2 inclusive.

The HT Contact Form 7 plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.8.2.

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification.

A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to a system execute leading to code execution.

A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on a USB stick leading to code execution. This can result in a total loss of confidentiality, integrity, and availability.

The getAccountData function has an SQL Injection vulnerability that can be exploited by an unauthenticated remote attacker. Improper neutralization of special elements in a SQL SELECT command leads to a total loss of confidentiality.

The inmessage model has a SQL Injection vulnerability that can be exploited by a low privileged attacker. Due to improper neutralization of special elements in a SQL DELETE command, the attacker can read the entire database and delete entries in a non-critical table.

The dash_layout.php file's saveDashboardLayout function has a remote SQL Injection vulnerability that can be exploited by a low privileged attacker. The flaw is due to improper neutralization of special elements in a SQL INSERT command, allowing for reading the entire database and inserting entries into a non-critical table.