SQL::Abstract versions before 2.000003 for Perl are vulnerable to SQL injection via array reference column values in insert, update, and generate operations. By default, with the array_datatypes option off, array references are treated as literal SQL, allowing unescaped input to be injected into SQL statements. This can occur when applications pass request data directly as column values, potentially enabling injection attacks. The vulnerability is fixed in version 2.000003.
CVE-2026-121571 is a missing authorization vulnerability in the WP Desk Autopay dla WooCommerce plugin versions before 2.3.1. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized actions within the plugin. The issue is fixed in version 2.3.1.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Code Injection.This issue affects Media LIbrary Assistant: from n/a through 3.43.
CVE-2026-119513 is a missing authorization vulnerability in Ahmad JS Help Desk affecting versions before 5.0.4. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue has been fixed in version 5.0.4.
CVE-2026-123468 is a missing authorization vulnerability in the StylemixThemes Motors plugin for motors-car-dealership-classified-listings. It affects versions from initial releases up to 1.4.128. The flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 1.4.129. The CVSS score is 4.3, indicating a medium severity impact primarily on integrity with no confidentiality or availability impact.
CVE-2026-120857 is a missing authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat versions prior to 6.1.10. The flaw allows exploitation due to incorrectly configured access control security levels. This vulnerability has a medium severity with a CVSS score of 5.3 and impacts confidentiality but not integrity or availability. A fix is available in version 6.1.10.
CVE-2026-123148 is a missing authorization vulnerability in TMS IvyForms versions before 1.5.2. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 1.5.2.
CVE-2026-120837 is a missing authorization vulnerability in Everest Forms versions prior to 3.6.4. It allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue is fixed in version 3.6.4.
CVE-2026-121724 is a missing authorization vulnerability in the WebberZone Contextual Related Posts plugin affecting versions prior to 4.5.4. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionalities. The issue is fixed in version 4.5.4.
CVE-2026-120364 is a stored cross-site scripting (XSS) vulnerability in Untapwp Vidplex versions prior to 1.0.4. The flaw involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can affect confidentiality, integrity, and availability. The issue is fixed in version 1.0.4.
CVE-2026-119523 is a missing authorization vulnerability in Cozmoslabs Paid Member Subscriptions plugin versions before 3.1.4. It allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The issue is fixed in version 3.1.4.
CVE-2026-119525 is a missing authorization vulnerability in the WP Desk Dropshipping XML for WooCommerce plugin versions prior to 1.7.5. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The issue is fixed in version 1.7.5.
CVE-2026-120365 is a stored cross-site scripting (XSS) vulnerability in the WP Customer Area plugin by Aguila Technologies. It affects versions from initial releases up to 8.4.3. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts. A fix is available in version 8.4.4.
The qzc690383 package on PyPI contains malicious code that executes during installation. It collects detailed host system information and sends it encoded to a local Xinference server, enabling an operator with access to that server to retrieve the host fingerprint. The package does not provide legitimate functionality and performs this reconnaissance even on a simple install.
The PyPI package 'qzc690382' version 1.0.0 contains malicious code that activates during installation. Its setup.py script writes and launches a persistent Python HTTP server on multiple ports, exposing a network-accessible shell that executes arbitrary shell commands received via HTTP GET requests. This backdoor runs with the privileges of the installing user and is unrelated to any legitimate functionality.
The PyPI package 'qzc690385' versions 1.0.0 and 1.0.1 contains malicious code that installs a Python HTTP server on installation. This server listens on multiple ports and allows remote execution of arbitrary shell commands via HTTP GET requests authenticated by a hardcoded token. Additionally, the package abuses a local Xinference API to execute code and exfiltrate host reconnaissance data encoded within model registration payloads. The package provides no legitimate functionality and is designed for stealthy remote control and data gathering.
CVE-2026-119478 is a medium severity vulnerability in StylemixThemes MasterStudy LMS versions prior to 3.7.57. It involves improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects all versions from initial through 3.7.56 and has been fixed in version 3.7.57.
CVE-2026-119508 is a missing authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services. It affects versions from initial releases up to 1.0.20. The flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.0.21.
CVE-2026-119492 is a medium severity vulnerability in Metaphor Creations, LLC Ditty plugin (ditty-news-ticker) that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) issue. The vulnerability affects versions from initial releases up to 3.1.71. It has been fixed in version 3.1.72.