NI vulnerabilities and threats

Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to 4.8.3 contains a privilege escalation vulnerability via the create_support_user() function. This flaw allows an attacker who controls an account with specific hardcoded credentials to be silently promoted to administrator or super admin on multisite setups. Exploitation requires that an attacker first obtain or create such an account, then a legitimate administrator must trigger the support-access feature to activate the privilege escalation.

Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.9 contains a privilege escalation vulnerability. Authenticated users with the edit_contacts capability can reassign contact records to arbitrary WordPress user IDs without requiring higher privileges. This allows attackers with sales_rep-level access to escalate to administrator by exploiting the auto-login link feature tied to contact notes.

The Fluent Forms WordPress plugin up to version 6.2.14 is vulnerable to reflected cross-site scripting (XSS) due to improper input sanitization and output escaping of user-controlled parameters in the {get.*} SmartCode placeholders. An unauthenticated attacker can inject malicious scripts if a site administrator has configured a Custom HTML field with a {get.*} SmartCode inside URL-accepting attributes. Exploitation requires tricking a user into interacting with a crafted link, potentially leading to script execution in the user's browser.

The Advanced IP Blocker WordPress plugin up to version 8.13.13 contains a critical authentication bypass vulnerability. This flaw allows unauthenticated attackers to bypass two-factor authentication (2FA) by exploiting improper server-side checks and nonce reuse. Attackers can brute-force a 6-digit TOTP code without rate limiting or lockout, gaining full authenticated sessions and potentially complete site takeover. Exploitation requires only knowledge of a valid user ID with 2FA enabled. The vulnerability is tracked as CVE-2026-104732 with a CVSS score of 9.8.

ILIAS versions before 9.24, 10.12, and 11.5 have an unrestricted file upload vulnerability in the QTI question import image handling component. Authenticated users with question pool import rights can upload crafted archives that write executable files, including .htaccess and PHP files, to web-accessible directories. This allows remote code execution as the web server user.

HortusFox (hortusfox-web) versions up to 6.3 have an unrestricted file upload vulnerability in the PlantAttachmentModel component. Authenticated users can upload files with arbitrary extensions to the public attachments directory. This allows uploading of HTML or SVG files that can lead to stored cross-site scripting (XSS), or PHP files that may execute code if .htaccess restrictions are not enforced.

HortusFox (hortusfox-web) versions before 6.2 contain an SQL injection vulnerability in the /api/locations/list endpoint. The flaw allows API token holders to inject SQL via crafted include_info values, enabling unauthorized reading of database tables including user password hashes. This vulnerability has a high severity score of 7.1 and does not require user interaction or privileges beyond API token access.

CVE-2026-86405 is a critical vulnerability in the Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module. It involves improper verification of cryptographic signatures, allowing signature spoofing due to improper validation. This affects versions from 26.8.1 up to but not including 26.9.1. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-85531 is a critical vulnerability in the OpenCart Virtual POS Module by Sipay Electronic Money and Payment Services Inc. It involves improper verification of cryptographic signatures, allowing signature spoofing due to improper validation. This affects versions from 26.8.2 up to but not including 26.9.1.

CVE-2026-94158 is a high-severity reflected cross-site scripting (XSS) vulnerability in the bkninja Gloria Admin Panel affecting versions up to 1.3. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability requires user interaction and can impact confidentiality, integrity, and availability of the affected system.

A URL redirection vulnerability (CWE-601) exists in AdonisJS HTTP Server versions prior to 8.2.3 and between 9.0.0 and before 9.3.0. The issue arises because route parameter values are inserted into URLs without proper encoding, allowing attacker-controlled input to create scheme-relative external URLs. This can enable attackers to redirect users to malicious sites, potentially facilitating phishing or abuse of authentication flows. The vulnerability is fixed in versions 8.2.3 and 9.3.0.

ILIAS versions before 9.24, 10.x before 10.12, and 11.x before 11.5 contain an argument injection vulnerability in the assImagemapQuestionGUI component. This flaw allows question authors to inject ImageMagick convert options via uploaded image filenames. By embedding tab-separated options that bypass escapeshellcmd(), an attacker can write a PHP file under the web root, leading to remote code execution.

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes.

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).

CVE-2026-102257 is a high-severity Zip Slip vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC) interface. It allows an attacker with high privileges to extract files outside the intended directory by using a specially crafted archive, potentially leading to remote code execution.

CVE-2026-102256 is a high-severity vulnerability in the SonicWall SMA1000 appliance involving improper neutralization of special elements in OS commands. This post-authentication flaw could allow a remote authenticated attacker with administrator privileges to execute arbitrary operating system commands, leading to remote code execution. The vulnerability requires authentication and low attack complexity. No specific affected versions or patch information is provided.

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

CVE-2026-107159 is a divide-by-zero vulnerability in miniupnpd up to version 2.3.11 when built with the --strict option. This flaw occurs in the ProcessSSDPData() function and can be triggered by unauthenticated local network attackers sending a multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900. Exploitation causes the daemon to crash, resulting in denial of UPnP IGD service.

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.