CVE Vulnerability Catalog

In CVE-2026-40810, an unauthenticated remote attacker can exploit an SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints in all versions up to and including 7.7. These endpoints accept CSS content from QUIC.cloud callback notifications and store it to disk without sanitization.

A local user with low privileges may influence the behavior of a privileged system service by manipulating configuration or application-related files in user-writable areas of the filesystem. The affected service processes data from locations that are not sufficiently protected against modification by low-privileged users.

Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device.

The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 0.2.1, allowing authenticated attackers with contributor-level access and above to include and execute arbitrary .php files on the server.

The Login with NEAR plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 0.3.3. The `ajaxLoginWithNear()` function allows attackers to log in as any existing WordPress user, including administrators, based on the supplied `account` parameter.

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 3.1.1. The `firebase_auth()` function authenticates the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email.

The EventPress WordPress theme before version 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.

An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implementation, which may lead to data leakage or tampering.

A vulnerability in the IO::Compress library for Perl before version 2.220 allows arbitrary code execution via an attacker-controlled output glob in File::GlobMapper. The issue stems from improper handling of double quotes in the output argument, leading to Perl code evaluation.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, do not prevent certain XML parsers from resolving external entities.

A flaw has been found in UTT HiPER 1250GW up to version 3.2.7-210907-180535 in the strcpy function of the /goform/formGroupConfig file of the Web Management Interface. Manipulating the Profile argument can lead to stack-based buffer overflow.

A vulnerability was detected in UTT HiPER 1250GW up to version 3.2.7-210907-180535, affecting the strcpy function in the /goform/formConfigFastDirectionW file of the Web Management Interface. Manipulating the Profile argument results in a stack-based buffer overflow.

A weakness has been identified in UTT HiPER 1200GW up to version 2.5.3-170306, affecting an unknown function of the file /goform/formPptpClientConfig in the Web Management Interface. Manipulation of the PPTP server address/username/password/tunnel name arguments causes stack-based buffer overflow.

A security flaw has been discovered in UTT HiPER 1200GW up to version 2.5.3-170306, affecting the strcpy function in the /goform/setSysAdm file of the Web Management Interface. Manipulation of the sysAdmUser/sysAdmPass arguments results in a buffer overflow.

Tanium addressed an unauthorized code execution vulnerability in Connect.

W OpenStack Swift przed wersjami 2.36.2 i 2.37.2, middleware s3api wchodzi w nieskończoną pętlę podczas przetwarzania skróconego ciała żądania PUT w formacie aws-chunked. Klasa StreamingInput wielokrotnie dodaje pusty bufor i ponownie odczytuje, co prowadzi do trwałej nieodpowiedzialności serwera proxy.

W GDAL w wersjach od 3.1.0 do 3.13.0, funkcja scanForGeometryContainers w sterowniku netCDF umożliwia wykonanie kodu poprzez przepełnienie bufora na stosie. Atakujący może osadzić exploit w postaci zbyt dużego atrybutu geometrii w stworzonym pliku NetCDF.

A vulnerability has been found in itsourcecode Courier Management System version 1.0, affecting an unknown function in the file /manage_user.php. Manipulation of the argument ID leads to SQL injection, which can be performed remotely.

A flaw has been found in GNU libredwg up to version 0.13.4.8160 affecting the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This issue leads to a heap-based buffer overflow that can be exploited remotely.