CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
The MultiParcels Shipping for WooCommerce plugin before version 1.15.4 does not sanitize and escape various parameters before outputting them back on the page, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This can be exploited against high privilege users such as admins.
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The Quiz And Survey Master WordPress plugin before version 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting vulnerability.
The WP Shopping Pages plugin for WordPress through version 1.14 lacks CSRF checks in some places and is missing sanitization and escaping, which could allow attackers to make logged in admins add Stored XSS payloads via a CSRF attack.
A flaw was found in the Linux kernel's TUN/TAP functionality, which could allow a local user to bypass network filters and gain unauthorized access to some resources. The issues stem from incorrect or incomplete patches for CVE-2023-1076.
In Fujitsu Software Infrastructure Manager (ISM) before version 2.8.0.061, authorization credentials are insecurely collected and stored in cleartext in the file /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log. This occurs when users test the connection to a firmware repository or regularly authenticate against a configured remote firmware repository, if a backslash character is used in the user credentials (ID or password).
In the Contacts service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In the vowifi service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In the Contacts service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
A critical vulnerability has been found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'id' argument in the view_fee.php file leads to SQL injection, which can be exploited remotely.
A critical vulnerability was found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'id' argument in the manage_user.php file leads to SQL injection, which can be executed remotely.
A critical vulnerability has been found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, which can be exploited remotely.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.3, allowing for the storage of malicious code.
A critical vulnerability was found in SourceCodester Pharmacy Management System version 1.0. It affects an unknown functionality of the file manage_website.php, leading to unrestricted file uploads.
A critical vulnerability was found in SourceCodester Online Hospital Management System version 1.0. Manipulation of the loginid and password arguments in the patientlogin.php file leads to SQL injection.