Threat database

Apache Qpid Proton C versions through 0.40.0 have a vulnerability in the SASL authentication frame dispatching process. The software incorrectly dispatches AMQP frames that claim to be SASL frames, allowing an authentication bypass. However, no user name is set during this bypass, so the impact depends on how the application handles an unauthenticated state. The issue is fixed in version 0.41.1.

A Missing Authorization vulnerability exists in ThimPress LearnPress up to version 4.4.11. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive data. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating network exploitable conditions without requiring privileges or user interaction. No patch or remediation information is currently provided.

A SQL Injection vulnerability exists in BuddyPress up to version 14.5.2. This flaw allows an attacker with low privileges to perform blind SQL injection attacks, potentially leading to high confidentiality impact and limited availability impact without requiring user interaction.

A Missing Authorization vulnerability exists in VideoWhisper.com Broadcast Live Video integration up to version 7.3.9. This flaw involves incorrectly configured access control security levels, potentially allowing unauthorized actions. The vulnerability has a CVSS score of 7.1, indicating high severity. No patch or remediation information is currently provided.

A reflected Cross-site Scripting (XSS) vulnerability exists in WP Swings Upsell Order Bump Offer for WooCommerce through version 3.1.6. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected website.

A stack read overflow vulnerability exists in Apache Qpid Proton C versions through 0.40.0 due to a misconfigured wildcard TLS certificate. The flaw does not affect wildcard certificates compliant with the RFC9525 standard. The issue is resolved in version 0.41.1, which restricts accepted certificates to those compliant with RFC9525.

A vulnerability in Apache Qpid Proton C through version 0.40.0 allows a deeply nested message body decoded by pn_message_body() to overflow the stack and cause a crash. The issue is fixed in version 0.41.1.

A signature verification vulnerability exists in the update installation process due to inconsistent validation of update bundle contents. An attacker with administrative privileges can supply a crafted update bundle that passes signature verification but executes an unsigned script with root privileges. This allows the attacker to read or modify sensitive data, alter appliance configuration, or shut down the appliance.

A reflected Cross-site Scripting (XSS) vulnerability exists in OceanWP through version 4.2.7. This vulnerability involves improper neutralization of input during web page generation, which can allow an attacker to inject malicious scripts that execute in the context of a victim's browser.

A vulnerability in Apache Qpid Proton C's OpenSSL TLS implementation causes the APIs pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() to add to rather than replace the default system trust anchors. This behavior can lead to trusting unexpected peer certificates. The issue does not affect the Win32 SChannel TLS implementation. It affects versions through 0.40.0 and is fixed in version 0.41.1.

A reflected Cross-site Scripting (XSS) vulnerability exists in PluginUs.Net TableOn posts-table-filterable component. This vulnerability affects versions up to and including 1.0.7. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected application.

Two OS command injection vulnerabilities exist in the update installation functionality due to insufficient validation of update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that executes arbitrary commands with root privileges. This allows reading or modifying sensitive data, changing appliance configuration, or shutting down the appliance.

An authentication bypass vulnerability exists in myCred up to version 4.0.1 that allows identity spoofing. This flaw could enable an attacker with some privileges to bypass authentication controls, potentially leading to limited integrity impact without affecting confidentiality or availability.

A critical SQL Injection vulnerability (CVE-2026-115964) exists in StylemixThemes Motors plugin up to version 1.4.126. This vulnerability allows an unauthenticated attacker to perform Blind SQL Injection, potentially leading to high confidentiality impact and partial denial of service.

OmniRoute versions 3.8.0 up to but not including 3.8.52 have a vulnerability allowing holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without knowing the current password. This can enable attackers to lock out legitimate operators, take over dashboard login, or disable login requirements.

A weak authentication vulnerability exists in the 'Login with phone number' component of Hamid Alinia Login, affecting versions up to 1.8.78. This flaw allows authentication abuse, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 (CVSS 3.1) and requires low privileges to exploit without user interaction.

A missing authorization vulnerability exists in the GEO my WordPress plugin (geo-my-wp) up to version 4.5.5.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data disclosure. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating network exploitable conditions without user interaction and resulting in high confidentiality impact but no integrity or availability impact.

The Everest Forms plugin for WordPress versions up to and including 3.6.2 suffers from a sensitive information exposure vulnerability. Unauthenticated attackers can exploit this flaw to extract arbitrary WordPress post meta values, such as license keys, API tokens, SMTP credentials, and secrets related to Stripe or AWS. This is possible because the submission nonce is publicly available in every embedded form and can also be generated anonymously via a specific action, requiring no authentication.

The LiteSpeed Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 7.9.1. This flaw arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires the HTML Minify option to be enabled and a companion plugin that renders stored comment content in a raw-text context such as a JSON-LD script block on the same page.

The HT Mega Addons for Elementor WordPress plugin (up to version 3.2.7) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the href attribute of anchor tags inside the .htmega-tab-nav parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a co-installed plugin like wpDiscuz with its rich editor enabled, an HT Mega Tabs widget on the same page, and a victim clicking the injected link.