Threat database

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.

HCL BigFix Service Management contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. These scripts execute when other users view the affected pages, potentially leading to session hijacking and theft of sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.2. No specific affected versions or patch information are provided.

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.

Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first. This has been patched in 16.3.8.

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.

Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.

Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.

Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.

Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

CVE-2026-97273 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in Premmerce Wishlist for WooCommerce versions up to 1.1.13. This flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability requires no privileges but user interaction is needed to trigger the exploit. It affects confidentiality, integrity, and availability of the affected system.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.

CVE-2026-97258 is a medium severity vulnerability in Aruba.it's Aruba Migration Tool versions up to 1.0.4. It involves missing authorization controls, classified as CWE-862, which could allow unauthorized access to subscriber-related functions. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a network attack vector with low complexity and no user interaction required. There is no indication of known exploits in the wild or an official patch available at this time.

Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.