Threat database

The Tainacan WordPress plugin versions up to and including 1.3.0 contain a directory traversal vulnerability via the 'tmp_file' parameter. Authenticated users with editor-level or higher privileges can exploit this flaw to read arbitrary files on the server. The vulnerability arises because a manipulated importer path is stored in the database and later accessed through a GET request to the /source_info endpoint, which reads and returns file contents via fopen() and fgetcsv().

The Contact Manager plugin for WordPress up to version 9.1.2 contains an arbitrary file upload vulnerability via the add_message function. This flaw arises from an incomplete file extension blacklist that can be bypassed using a trailing dot, causing dangerous file types to be uploaded. An unauthenticated attacker can exploit this to upload potentially executable files, enabling remote code execution on servers running Apache with libapache2-mod-php. The exploit requires the attacker to access the uploaded file before it is deleted at the end of the request.

The Document Embedder plugin for WordPress up to version 2.4.0 is vulnerable to a stored DOM-based cross-site scripting (XSS) flaw. Authenticated users with contributor-level access or higher can inject malicious scripts via the 'content' parameter in post content JSON. The injected scripts execute when a user clicks the embedded document's Download button, exploiting an AJAX fallback that improperly handles authorization checks. This vulnerability arises from insufficient input sanitization and output escaping.

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'conversion' shortcode attribute. This affects all versions up to and including 1.10.2. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.

The Avada (Fusion) Builder plugin for WordPress versions up to and including 3.16.2 contains a stored cross-site scripting (XSS) vulnerability via the 'tab_index' and 'empty_notice' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts into pages. The wp_kses_post function does not remove the payload because the malicious content is embedded within shortcode attribute text, which is treated as plain text rather than HTML markup.

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'url' parameter. This affects all versions up to and including 1.10.2. Authenticated users with contributor-level access or higher can inject malicious scripts that execute in administrator browser sessions when previewing or opening the affected post.

The Awesome Support WordPress plugin versions up to and including 6.4.1 contain a stored cross-site scripting (XSS) vulnerability via the 'wpas_files' parameter. This flaw allows authenticated users with custom-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the 'Enable drag-n-drop uploader for ticket form' setting to be enabled, which is disabled by default.

The Postie plugin for WordPress versions up to and including 1.9.87 is vulnerable to stored cross-site scripting (XSS) via the Email Body URL Autolink feature. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The ?postie=get-mail endpoint is accessible without authentication or capability checks, and the email processing removes WordPress's kses filters, enabling raw markup with unescaped href attributes to be stored as post content. This can lead to script execution when users access the injected content.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain a Missing Authorization vulnerability (CWE-862). This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. Fixed versions are available starting from 8.9.0.0 and certain later LTS releases.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including specific LTS releases, contain an authentication bypass vulnerability by spoofing. This flaw allows a low privileged remote attacker to potentially cause denial of service. The vulnerability is identified as CWE-290 and has a CVSS 3.1 score of 6.4 (medium severity).

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a heap-based buffer overflow vulnerability (CWE-122). This flaw can be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVE-2026-14571 is a critical Blind SQL Injection vulnerability in Futurum Software's User Authentication Module. It arises from insufficient validation and sanitization of user inputs in database queries and an incorrect Web Application Firewall (WAF) configuration. This flaw allows unauthenticated attackers to bypass protection mechanisms by sending manipulated HTTP requests, enabling arbitrary query execution on the database. Exploitation could lead to extraction of the database structure and access to sensitive customer data, including personally identifiable information (PII). A fix was released in May 2026.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain an OS command injection vulnerability (CWE-78). This flaw allows a high privileged remote attacker to execute arbitrary commands on the affected system. The vulnerability is addressed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later. The CVSS 3.1 score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability.

CVE-2026-101767 is a critical unauthenticated SQL injection vulnerability in Oracle E-Business Suite's Application Object Library. It allows remote attackers to execute arbitrary code and fully compromise the affected component. The flaw was patched in Oracle's October 2026 CPU, and exploitation attempts were observed shortly after the patch release.

Multiple vulnerabilities have been addressed in Splunk Enterprise as reported by the Nationaal Cyber Security Centrum. The specific details of these vulnerabilities, including their nature and impact, are not provided in the available information.

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and specific LTS releases contain an OS Command Injection vulnerability (CWE-78). This flaw allows a low privileged remote attacker to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 8.8. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a critical improper authentication vulnerability (CWE-862). An unauthenticated remote attacker could exploit this flaw to create privileged accounts, potentially gaining full control of the system. Dell has released fixed versions starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 onwards and recommends upgrading promptly.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a path traversal vulnerability (CWE-22). This flaw allows a low privileged attacker with remote access to potentially access the filesystem beyond intended restrictions. The vulnerability is rated high severity with a CVSS score of 8.8. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.