Xerte Online Toolkits versions up to 3.15.5 contain a remote code execution vulnerability. Authenticated users with system permissions can exploit this flaw by importing a specially crafted language pack ZIP file containing a .inc file. This file can then be accessed via the language parameter to execute arbitrary PHP code on the server, leading to full compromise.
A NULL pointer dereference vulnerability exists in libexpat through version 2.9.0 within the externalEntityInitProcessor2() function. This flaw mishandles the XML_TOK_NONE token from empty input, allowing attackers who control stream chunking to cause a crash by forcing an empty non-final first parse on an external entity subparser.
LibreSSL versions through 4.4.0 have a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions. This flaw allows attackers to inject carriage return and line feed characters into the OCSP POST request line by embedding them in a certificate's Authority Information Access OCSP URI. The vulnerability could enable injection of HTTP headers or splitting of requests sent to OCSP responders and proxies.
rtl_433 versions through 25.12 have a stack-based buffer overflow vulnerability in the proflame2_mc() function. This flaw allows an attacker within radio range to send more than seven valid Manchester-coded words, overflowing a 7-byte stack buffer. Exploitation can cause rtl_433 to crash and potentially corrupt stack memory, enabling control-flow hijacking on builds lacking stack canaries.
Assimp versions through 6.0.5 have an integer overflow vulnerability in the MD2Importer::ValidateHeader() function. This flaw allows attackers to craft malicious .md2 files with manipulated header fields that bypass frame table bounds checks. Exploiting this can cause heap out-of-bounds reads, potentially crashing applications or exposing adjacent heap memory.
NexoPOS versions through 6.3.0 have a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions. This occurs because the CashRegistersService does not verify that the user performing actions on a register session matches the session's assigned user. Attackers with the default permission nexopos.use.registers can submit requests to forcibly close sessions or alter cash balances via the API endpoint POST /api/cash-registers/{action}/{register}.
The Ultimate Member WordPress plugin up to version 2.14.0 is vulnerable to stored cross-site scripting (XSS) via the 'user_url' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected profile pages. Exploitation requires a visitor to click the injected Website URL link, which is enabled by default in new installations.
The AI Marketing Expert WordPress plugin (up to version 1.2.8) contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'name' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of administrators accessing the injected pages. Exploitation requires the chatbot module to be active with at least one configured bot. The attack involves storing the payload via unauthenticated REST calls, which is then delivered through the JavaScript widget's auto-polling mechanism.
The All-in-One Video Gallery plugin for WordPress, up to and including version 4.9.7, contains a stored cross-site scripting (XSS) vulnerability via the 'more_link' parameter. This flaw allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
nopCommerce versions before 5.00.0 have a missing authorization vulnerability in the admin ProductController handlers RelatedProductAddPopup, CrossSellProductAddPopup, and AssociatedProductAddPopup. This flaw allows authenticated vendors to submit another vendor's product ID to inject their products into the victim's related, cross-sell, and grouped product listings.
The All-in-One Video Gallery plugin for WordPress versions up to and including 4.9.7 is vulnerable to stored cross-site scripting (XSS) via the 'custom_fields[embedcode]' parameter. Authenticated users with subscriber-level access or higher can exploit this vulnerability by injecting malicious scripts through XML-RPC requests, which execute when other users access the affected pages. This occurs due to insufficient input sanitization and output escaping, combined with a logic flaw that grants subscribers publishing capabilities and bypasses sanitization during XML-RPC calls.
The affiliate-toolkit WordPress plugin (up to version 3.9.2) is vulnerable to stored cross-site scripting (XSS) via the 'atkp_product_producturl' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires the plugin's AJAX loading or AJAX handler feature to be enabled, or contributor-level access if these features are disabled by default.
The AI Engine WordPress plugin (up to version 3.8.4) contains a vulnerability in its upload_file function that allows authenticated users with subscriber-level access or higher to delete arbitrary media files. Exploitation requires the Public API option to be enabled by an administrator and depends on a scheduled cleanup task running after a malicious upload. This vulnerability is due to insufficient file path validation.
GROWI has an authorization bypass vulnerability in its tag update and page update APIs. This flaw arises from improper use of a user-controlled key, allowing authenticated attackers to access page contents without proper read permissions and save them to pages they can edit.
GROWI has an authorization bypass vulnerability affecting its page viewing and commenting features. This flaw arises from improper use of a user-controlled key, allowing authenticated attackers to access page contents and comments without proper read permissions. The vulnerability has a medium severity rating with a CVSS score of 4.2.
CVE-2026-118272 is a medium severity vulnerability in a2ui-project a2ui up to version 0.10.6. It affects the DataContext.dispatchExpressionError function in the Error Handler component, allowing remote attackers to cause information exposure through error messages. Public exploit code is available. A patch identified by commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01 addresses the issue.
The Jupiter X Core plugin for WordPress contains an authentication bypass vulnerability in its Twitter/X social login handler affecting all versions up to and including 4.61.0. The flaw arises because the plugin fails to update the OAuth token after exchanging the oauth_verifier, causing it to authenticate users based on the site administrator's Twitter credentials rather than the visitor's. This allows unauthenticated attackers to gain authenticated access as the WordPress user linked to the Twitter app owner's email, typically the site administrator.
A resource consumption vulnerability exists in a2ui-project a2ui up to version 0.10.6 in the data-context Resolver component. The issue affects the file renderers/web_core/src/v0_9/rendering/data-context.ts and can be exploited remotely without user interaction. The vulnerability has a medium severity with a CVSS score of 4.3 and has been publicly disclosed. A patch identified by commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 is available to address this issue.
CVE-2026-118275 is a resource consumption vulnerability in the a2ui-project a2ui component, specifically affecting versions 0.10.0 through 0.10.6. The flaw exists in the DataContext.resolveSignal function within the Resolver component. This vulnerability can be exploited remotely without authentication and has publicly available exploit code. A patch identified by commit c76e17272e52c12c6dcf68905b1df978c39e9aa5 addresses the issue. The CVSS 4.0 score is 6.9, indicating a medium severity level.
CVE-2026-118384 is a vulnerability in GNU mtools up to version 4.0.49 involving an out-of-bounds write in the parse_vses function within the vfat.c source file. This flaw is due to a numeric range comparison without a minimum check (CWE-839). The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level. It requires local access with low complexity and no privileges but user interaction is needed. The impact includes integrity loss and high availability impact, but no confidentiality impact is reported.