Threat database

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.

CVE-2026-21157 is a high-severity vulnerability in Samsung Mobile's Bixby prior to version 4.0.85.6. It involves improper input validation that allows privileged local attackers to launch arbitrary activities on the device.

An XML Signature Wrapping vulnerability in Moldova's MPass SAML NuGet library allows authentication bypass by relocating signed elements within SAML responses. This flaw affects versions 8.0.53 to 8.0.56 and 10.0.2 and was fixed in versions 10.0.4 and 10.0.5. The issue arises because the signature verification did not ensure that the signed reference matched the root element of the response, enabling attackers to authenticate as arbitrary users.

A weakness in nschloe meshio up to version 5.3.5 affects the VTK Reader component in the file meshio/_vtk_42.py. Manipulating the DIMENSIONS argument can cause uncontrolled memory allocation. The vulnerability can be exploited remotely and has a medium severity rating with a CVSS score of 5.3. The project has been informed but has not yet responded or issued a fix.

A security flaw in dfm feedfinder2 up to version 0.0.4 allows remote attackers to perform server-side request forgery (SSRF) via the find_feeds function in feedfinder2.py. This vulnerability enables an attacker to manipulate server requests, potentially accessing internal resources. The issue was reported to the project early, but no response or fix has been issued yet.

A cross-site scripting (XSS) vulnerability exists in the addlist.php file of the Add Product Page component in configuroweb inventariobasico. The vulnerability arises from improper handling of the product name argument, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vulnerability has a low CVSS score of 3.5 and public exploit code is available. The project has been notified but has not yet responded or issued a fix.

A security flaw in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8 affects the Request Forwarder component, allowing information disclosure. The vulnerability can only be exploited from the local network. Public exploit code is available, but the vendor has not yet responded or issued a fix. The CVSS score is 4.3, indicating medium severity.

Mattermost versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, and 11.7.x up to 11.7.10 contain a vulnerability in the Agents plugin's mention reminder component. This flaw allows an authenticated user with posting permissions in a channel visible to a system administrator to craft a post with a forged mention reminder. If the administrator clicks this mention, their browser sends an unintended API request that can replace an installed plugin, leading to remote code execution on the server.

A critical vulnerability exists in D-Link DIR-505 version 1.10B02 in the Web Management CGI component. The flaw is in the main function of the /secmark1524.cgi file, where manipulation of certain arguments can create a backdoor. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attacks.

A server-side request forgery (SSRF) vulnerability exists in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8 within an unknown function of the Request Forwarder component. This vulnerability allows remote attackers to manipulate requests, potentially leading to unauthorized internal network interactions. Public exploit code is available. A patch identified by commit b0d3876247a0a64fa0e430e4b21870e41f503182 is recommended to fix the issue.

Volmarg Personal Management System versions up to 2.1.0 contain an OS command injection vulnerability. Authenticated users can exploit this flaw by creating directories with shell metacharacters in the upload/files path and then moving or copying them, resulting in arbitrary shell command execution as the web server user.

Bricks Builder versions 2.4.3 and earlier have a broken access control vulnerability that allows unauthenticated attackers to access restricted post content. By submitting crafted post_status and post_type values to a specific REST endpoint with a publicly obtainable nonce, attackers can view unpublished posts, private content, and WooCommerce coupon data that should be restricted.

gopass versions prior to 1.17.0 have a path traversal vulnerability in the filesystem storage backend. This flaw allows attackers with write access to a shared git-synced password store to craft entries with '../' sequences. When a victim runs a recursive removal command (gopass rm -r), these crafted entries can cause deletion of directories outside the intended password store location.