An improper input validation vulnerability exists in the network communication processing of NEC Corporation WebSAM WinShare versions 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 on Windows. This flaw allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges by sending a crafted network packet to the affected system.
A vulnerability exists in the fushengqian fuint software affecting the receipt function in ClientOrderController.java. The flaw can be exploited remotely to cause a state issue, potentially impacting the integrity of the system. The product uses a rolling release model, and no specific affected or fixed versions are disclosed. The vendor has not responded to the disclosure. The CVSS score is 4.3, indicating a medium severity impact with low complexity and no user interaction required.
An improper access control vulnerability exists in the program installation folder of NEC Corporation WebSAM Winshare versions 7.5.0 and earlier (excluding 7.3.3), version 7.6.0, and versions 7.7.0 through 7.7.1 on Windows. This flaw allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges by placing a crafted DLL file that is loaded by a SYSTEM-level process.
A stack-based buffer overflow vulnerability exists in the SetVLANSettings function of the prog.cgi file in the HNAP Handler component of D-Link DIR-878 firmware version 1.20B05. This vulnerability can be exploited remotely by manipulating the VID argument. The affected product is no longer supported by the vendor. Public exploit code has been disclosed, and the vulnerability has a high severity score of 7.5.
CVE-2026-124573 is a medium-severity vulnerability in logseq versions 2.0.1 and 2.0.2 affecting the Local HTTP API component. The flaw involves missing authentication in the validate-auth-token function, allowing remote attackers to potentially bypass authentication. Public exploit code exists, but no official response or patch has been issued by the project as of the publication date.
CVE-2026-124572 is a path traversal vulnerability in the Catalogue Upload API of DataLinkDC dinky versions 1.2.0 through 1.2.5. The flaw exists in the CatalogueController.upload function, allowing remote attackers to manipulate file paths. This vulnerability has a medium severity rating with a CVSS score of 5.3. No public exploits or patches are currently documented.
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.
The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free.
This is due to an incomplete fix of CVE-2026-34898.
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.
The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.
The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled.
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.