CVE Vulnerability Catalog

The Ni WooCommerce Sales Report plugin before 4.2.0 lacks authentication/authorization checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, target individual orders, and search orders by customer name or email.

The Eventin plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.

The WP Import Export Lite plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with import capability (administrators by default) to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.

The WP Import Export Lite plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.

The WP Import Export Lite plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the import permission to perform SQL injection attacks.

The WP Import Export Lite plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission (administrators by default, may also grant to lower roles) to perform SQL injection attacks.

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing users with import permission to disclose sensitive files from the server, including files outside the web root. The same code path also relaxes file-system permissions of any path it is given, whether or not the copy succeeds.

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a capability to delete arbitrary directories and every file within them, including outside the web root.

The Bold Page Builder plugin for WordPress (all versions up to and including 5.9.6) is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode. This is due to a bypassable security filter (bt_bb_save_pre) circumvented via null byte injection, combined with insufficient output sanitization of base64-decoded content in the bt_bb_raw_content shortcode handler. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when users visit them.

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.22) is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking a link.

The WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) is vulnerable to blind SQL Injection via the 'order_by' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with custom-level access or higher can append additional SQL queries to existing queries, allowing extraction of sensitive information from the database.

The Advanced Popups plugin for WordPress (all versions up to and including 1.2.3) is vulnerable to Stored Cross-Site Scripting via the 'Notification Button Link' field due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or higher can inject arbitrary web scripts into pages that execute when users visit them.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (all versions up to and including 2.8.16) is vulnerable to authorization bypass due to a missing capability check on the 'ai-debug-code' URL parameter. An unauthenticated attacker can view administrator-configured header and footer code blocks that have been disabled from public display.

A security vulnerability has been detected in synaptik-cms (up to version 1.3.4.4) in the rename function of admin/file-manager.php within the Admin File Manager component. Manipulation leads to unrestricted file upload. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used. Upgrading to version 1.3.5 mitigates this issue.

A vulnerability was determined in gedelumbung HospitalManagement (up to c2d45543789a3887067d3915f69d44cfc2cf76a8) in the generate_index_pasien function of application/models/app_global_admin_model.php. Manipulation of the 'cari' argument can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be utilized. The project has not responded to the issue report.

A vulnerability was found in vLLM versions 0.26.0 and 0.27.0 within the MoRIIO Acknowledgement Handler component. Manipulation of the request_id/kv_transfer_params arguments in MoRIIOConnectorScheduler.request_finished, MoRIIOConnectorWorker.get_finished, and MoRIIOWrapper._handle_release_message leads to resource consumption. The attack can be initiated remotely, and the project has not yet reacted to the report.

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because it does not restrict the digest algorithm used for artifact verification. An attacker with sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.