Threat database

A CSV injection vulnerability exists in Bahleel versions 0.1.0 and 0.1.1 within the fputcsv function of app/Exporters/CsvExporter.php. This vulnerability allows remote attackers to manipulate CSV output, potentially leading to malicious formula execution when the CSV is opened in spreadsheet software. The issue was reported early to the project, but no response or fix has been provided yet.

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Axis2/Java versions through 2.0.1. An unauthenticated attacker can supply a non-anonymous WS-Addressing ReplyTo or FaultTo address, causing Axis2 to open connections to arbitrary internal hosts and deliver response content to an attacker-controlled host. This behavior is fixed starting in version 2.0.2 by refusing decoupled responses unless explicitly enabled and restricting allowed endpoints by scheme and header/transport validation.

Apache Axis2/Java versions through 2.0.1 have a Direct Request ('Forced Browsing') vulnerability where service metadata is exposed through multiple endpoints despite the exposeServiceMetadata parameter being disabled for certain queries. This allows anonymous callers to access metadata including operation names and request/response schemas. The issue is fixed in version 2.0.2.

CVE-2026-124621 is a high-severity vulnerability in the kongxin-github Java_Library_Management_System affecting multiple functions in the Swing UI Layer. It causes improper authorization, allowing remote attackers with limited privileges to perform unauthorized actions. The vulnerability has been publicly disclosed with available exploit details. The project uses a rolling release model and has not yet provided a fix or response.

A Cross-site Scripting (XSS) vulnerability exists in the OpenAPI module of Apache Axis2/Java. The Swagger UI page improperly includes a value derived from the HTTP Host header without proper encoding, enabling script injection in the context of the Axis2 origin. This affects version 2.0.1 and is fixed in version 2.0.2.

Apache Axis2/Java versions through 2.0.1 have a resource allocation vulnerability where multipart/form-data and application/x-www-form-urlencoded message builders do not limit request body size, bypassing servlet container post-size limits and failing to delete temporary files. This allows unauthenticated attackers to exhaust memory or disk resources. The issue is fixed in version 2.0.2 by adding configurable size limits and proper cleanup of temporary files.

Mang Board WP versions up to 2.4.7 are affected by a reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of a user's browser session.

A Cross-site Scripting (XSS) vulnerability exists in If-So Dynamic Content Personalization through version 1.10.3 due to improper neutralization of input during web page generation. This flaw allows reflected XSS attacks, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability has a high severity rating with a CVSS score of 7.1.

A Missing Authorization vulnerability exists in PT Norther Lights Production MapSVG (mapsvg-lite-interactive-vector-maps) affecting versions up to 8.16.3. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector and no privileges or user interaction required.

A stored cross-site scripting (XSS) vulnerability exists in the wpWax Directorist plugin up to version 8.10.7. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that execute in the context of other users. The flaw impacts confidentiality, integrity, and availability to a limited extent. No official patch or remediation details are provided in the available data.

A stored Cross-site Scripting (XSS) vulnerability exists in Mang Board WP through version 2.4.7 due to improper neutralization of input during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to potentially execute script code in the context of another user. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

A stored cross-site scripting (XSS) vulnerability exists in the Nickboss WordPress File Upload plugin (wp-file-upload) through version 5.2.2. This flaw allows improper neutralization of input during web page generation, enabling attackers to inject malicious scripts that can execute in users' browsers.

A stored cross-site scripting (XSS) vulnerability exists in the Featured Image from URL component of fifu.app up to version 6.1.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers.

A stored cross-site scripting (XSS) vulnerability exists in Plugins360 Labs All-in-One Video Gallery up to version 5.0.0. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

An XML External Entity (XXE) vulnerability exists in Apache Axis2/Java versions through 2.0.1. When a client builds an AxisService from a WSDL URL, imported documents are parsed by wsdl4j's XML parser, which processes external entities. This allows an attacker controlling a WSDL or its imports to read local files or cause the JVM to make network requests. The issue is fixed in version 2.0.2.

A stored cross-site scripting (XSS) vulnerability exists in WP Chill RSVP and Event Management plugin versions up to 2.7.17. This vulnerability allows attackers to inject malicious scripts that are executed in the context of users visiting affected pages.

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Axis2/Java versions through 2.0.1. The vulnerability allows an attacker who controls a WSDL or schema processed by an Axis2 application to cause the JVM to send requests to arbitrary internal or external hosts by exploiting the lack of scheme or host restrictions when fetching absolute URLs in wsdl:import locations and schemaLocations. This issue is fixed in version 2.0.2.

A stored cross-site scripting (XSS) vulnerability exists in the TI WooCommerce Wishlist plugin up to version 2.14.0. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.

Apache Axis2/Java versions through 2.0.1 contain a vulnerability where JSON message builders buffer the entire request body without size limits, allowing unauthenticated attackers to exhaust server memory with large JSON requests. This resource exhaustion issue is fixed in version 2.0.2 by introducing a configurable jsonMaxRequestSize parameter to limit JSON request sizes.

A Missing Authorization vulnerability exists in WP E-Signature Formidable Forms Signature Online Contract Automation up to version 2.0.5. This flaw allows unauthorized remote attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data disclosure. The vulnerability has a high severity with a CVSS score of 7.5.