Threat Intelligence Database

RosarioSIS versions prior to 12.9.1 have an authorization bypass vulnerability that allows authenticated teachers to modify records for students outside their assigned course periods. By manipulating specific POST parameters in several PHP scripts, attackers can create or alter referrals, eligibility codes, attendance, and final grades for any student in the system.

Camaleon CMS versions before 2.9.3 have a path traversal vulnerability that allows users with media permissions to write arbitrary files by manipulating the name parameter with ../ sequences. This can be exploited by sending a base64 data URI to the crop_url media action, enabling attackers to write an ERB template into a theme's views directory, which executes when rendered.

DaybydayCRM versions up to 2.2.1 have a missing authorization vulnerability in the ProjectsController::updateAssign() function. This flaw allows any authenticated user, including low-privileged employees, to reassign projects without having the required permission. Attackers can send PATCH or POST requests to the /projects/updateassign/{external_id} endpoint with a chosen user_assigned_id to redirect project ownership and notifications.

The aBlocks WordPress plugin up to version 2.17.0 contains a privilege escalation vulnerability via a REST endpoint that allows authenticated users with Contributor-level access or higher to elevate their role to Editor or other non-administrator roles. This occurs because the endpoint does not properly verify permissions and reads role information from attacker-controlled content. The vulnerability is bounded to roles below administrator level.

Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.

The php2shell vulnerability requires multiple consecutive requests to the same PHP worker process and knowledge of the exact PHP build to exploit. Due to typical production environments having multiple PHP workers behind load balancers and constant background traffic, exploitation is impractical against moderate to high traffic sites. Exploiting the vulnerability involves a denial-of-service-like brute force approach over days or weeks, which is likely to be detected and mitigated by existing protections such as WAFs and rate limiting. While critical and deserving prompt patching, the vulnerability is mainly a practical threat to very low-traffic, unprotected sites. No confirmed successful exploitation in the wild has been observed at the time of analysis.

CVE-2026-115998 is an Insecure Direct Object Reference (IDOR) vulnerability in CervantesSec cervantes version v1.3-beta. It allows an authenticated attacker to access sensitive data such as findings, proof-of-concept details, credentials, and client information from projects they do not belong to. The attacker can also modify finding statuses and transfer findings to their own projects, impacting data confidentiality and integrity.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

CVE-2026-115994 is an authorization bypass vulnerability in CervantesSec cervantes version v1.3-beta. It allows an attacker with limited privileges to modify or delete targets belonging to other projects without proper authorization. This compromises the integrity of penetration testing scopes, results, and associated security reports. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

CVE-2026-115993 is a stored cross-site scripting (XSS) vulnerability in the Notes field of the Checklists feature in Cervantes version v1.3-beta. This flaw allows an attacker to inject malicious scripts that execute in another user's browser with elevated privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation information is currently available, and there are no known exploits in the wild.

Cloudflare has introduced a post-quantum (PQ) GeoKey Manager that restricts decryption keys to be unwrapped only within designated geographic regions. This system uses hybrid post-quantum cryptography (ML-KEM-768 plus X25519) to protect keys, ensuring that regional root keys never leave their authorized regions and are stored only in volatile kernel memory on authorized edge servers. The GeoKey Manager supports data sovereignty by enforcing geographic boundaries on key usage, preventing decryption outside the chosen region. It is currently in closed beta with general availability planned for Q1 2027.

Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.

Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.