CVE Vulnerability Catalog

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST['post_type'] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.

Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.

Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.

In a2ui-project a2ui up to 0.10.6, the DataContext.dispatchExpressionError function in renderers/web_core/src/v0_9/rendering/data-context.ts (Error Handler component) exposes information through error messages. The vulnerability is remotely exploitable and a public exploit is available; the patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01.

In a2ui-project a2ui up to 0.10.6, a function in renderers/web_core/src/v0_9/rendering/data-context.ts (data-context Resolver component) allows resource consumption. The attack is remote and a public exploit has been disclosed; the patch is named eb314e14fabd29cfb4a74e1202afc4fe2081efa2.

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc in the isConfigMessageEvent function of src/Bootstrap.tsx within the PostMessage Handler component. Manipulating the parentDomain argument results in improper authentication, and the exploit has been made public and could be used. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688.

In Thor Vector Graphics (ThorVG) prior to 1.0.7, the SfntLoader::gen function in tvgSfntLoader.cpp reads data without first checking that the buffer contains at least four bytes, causing an out-of-bounds read. Loading an undersized font via memory APIs may crash the application or disclose adjacent heap memory.

The WebSub intent-verification protocol requires a subscriber to echo the hub.challenge value but does not require safe response media typing or disabled MIME sniffing. An attacker can redirect a victim browser to a crafted verification request containing HTML or JavaScript, potentially executing code in the subscriber origin.

The private keys of eight eMudhra intermediate CA certificates have been compromised, and the certificates were revoked on October 18, 2026. CVE-2026-22063 tracks relevant changes in NetApp products rather than describing a software vulnerability.

An uninitialized resource vulnerability in ANGLE in Google Chrome before version 156.0.8078.73 allows a remote attacker to read memory outside the sandbox via a crafted HTML page.

An integer overflow in Skia in Google Chrome before version 156.0.8078.73 may allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.