Threat database

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.

Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.

Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.

Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

CVE-2026-39723 is a Missing Authorization vulnerability in the Green Invoice Morning for WooCommerce plugin (wc-gateway-greeninvoice). It affects versions from the initial release up to 2.4.1. The flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions that impact integrity without affecting confidentiality or availability.

Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

CVE-2026-32582 is a missing authorization vulnerability in the iatoai IATO MCP product, affecting versions from initial releases up to 1.12.0. The flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or remediation details are provided in the available data.

Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2.

Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

CVE-2026-105705 is a medium severity cross-site scripting (XSS) vulnerability in SourceCodester Drug Recommendation System version 1.0. The flaw exists in an unspecified function within the Admin/add_drug.php file and can be exploited remotely. Public exploit code is available, increasing the risk of attack. No patch or vendor advisory is currently provided.

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user_id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and might be used.

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-105611 is an improper authorization vulnerability in chillzhuang SpringBlade versions 5.0.0 and 5.0.1. It affects a function in the User Detail Endpoint within the RoleController.java file. The vulnerability allows remote attackers to manipulate an argument ID, bypassing authorization controls. The issue was reported early to the project but remains unaddressed. The vulnerability has a medium severity rating with a CVSS score of 5.1. Exploit details have been publicly disclosed but no known exploitation in the wild has been reported.

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument initPassword results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

The Universal Library for Linux (uldaq) by Measurement Computing Corporation contains a stack-based buffer overflow vulnerability. No specific affected versions or patch information are provided. There is no evidence of known exploits in the wild.