CVE-2026-0782 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web interface. It allows authenticated remote attackers to execute arbitrary code on affected devices due to improper validation of user-supplied input used in system calls. Exploitation requires authentication but no user interaction beyond that. The vulnerability impacts confidentiality, integrity, and availability of the device, potentially enabling full control by attackers. No known exploits are currently reported in the wild. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety sectors, face significant risks. Mitigation involves applying vendor patches once available, restricting access to the device’s web interface, and implementing strict input validation and network segmentation. Countries with higher adoption of ALGO products and strategic use in public safety communications are most at risk. The CVSS score of 7.2 reflects a high severity due to network exploitability and full system compromise potential.
CVE-2026-0781 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web interface. It allows authenticated remote attackers to execute arbitrary code on affected devices due to improper input validation before system calls. Exploitation requires valid authentication but no user interaction beyond that. The vulnerability impacts version 5.5 of the product and can compromise confidentiality, integrity, and availability of the device. No public exploits are known yet. European organizations using this device in critical communication or alerting roles face risks of operational disruption and data compromise. Mitigation involves applying vendor patches once available, restricting device access, and monitoring for anomalous activity. Countries with higher adoption of ALGO products and critical infrastructure deployments are more likely to be affected.
CVE-2026-0780 is a high-severity OS command injection vulnerability in the web UI of ALGO 8180 IP Audio Alerter devices, allowing authenticated remote attackers to execute arbitrary code. The flaw stems from improper validation of user input used in system calls, enabling code execution with device-level privileges. Exploitation requires authentication but no user interaction beyond that. The vulnerability impacts version 5.5 of the product and has a CVSS score of 7.2, indicating significant confidentiality, integrity, and availability risks. No public exploits are currently known. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety communications, face potential operational disruption and data compromise. Mitigation involves applying vendor patches once available, restricting administrative access, and monitoring device logs for suspicious activity. Countries with higher adoption of ALGO IP Audio Alerter systems and critical public safety deployments, such as Germany, France, and the UK, are most likely affected.
CVE-2026-0779 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter device, specifically in its web-based user interface. The flaw arises from improper validation of user-supplied input used in system calls, allowing authenticated remote attackers to execute arbitrary code on the device. Exploitation requires authentication but no user interaction beyond that. The vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently reported in the wild. European organizations using ALGO 8180 devices, especially in critical infrastructure or public safety communications, face significant risks. Mitigation involves applying vendor patches when available, restricting administrative access, and monitoring device logs for suspicious activity.
CVE-2026-0796 is a high-severity OS command injection vulnerability in the ALGO 8180 IP Audio Alerter's web UI. It allows authenticated remote attackers to execute arbitrary code on the device due to improper validation of user input before system calls. Exploitation requires valid credentials but no user interaction beyond authentication. The vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently reported in the wild. This flaw could be leveraged to disrupt audio alerting systems or pivot into internal networks. European organizations using ALGO 8180 devices should prioritize patching or mitigating this issue. Countries with critical infrastructure or large deployments of ALGO products are at higher risk. Immediate mitigation includes restricting access to the device UI, enforcing strong authentication, and monitoring for suspicious activity. The CVSS score is 7.
Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through <= 1.8.16.
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's babe-search-form shortcode in all versions up to, and including, 1.8.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-12381 is an Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer versions A33.0 (up to build 320) and A33.10 (up to build 220) on Linux 64-bit systems. It allows a local user with command line access to escalate privileges by exploiting parameters of a command approved in the sudoers file. The vulnerability requires low attack complexity but partial user interaction and some privileges to exploit. It does not affect confidentiality but can severely impact integrity and availability by allowing unauthorized privilege escalation. No known exploits are currently in the wild. European organizations using affected AlgoSec Firewall Analyzer versions should prioritize patching or mitigating this issue to prevent potential local privilege escalation attacks. The CVSS 4.0 score is 6.
Improper Limitation of a Pathname 'Path Traversal') vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210).
Cross-Site Request Forgery (CSRF) vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Cross Site Request Forgery.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through <= 4.9.3.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Reflected XSS.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through <= 4.9.0.
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bookingalgorithms BA Book Everything ba-book-everything.This issue affects BA Book Everything: from n/a through <= 1.6.20.
The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user's identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user's passwords, including administrators. It's important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.
The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the my_account_update() function. This makes it possible for unauthenticated attackers to update a user's account details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to reset a user's password and gain access to their account.
The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Improper Control of Generation of Code ('Code Injection') vulnerability in AlgolPlus Advanced Order Export For WooCommerce allows Code Injection.This issue affects Advanced Order Export For WooCommerce: from n/a through 3.4.4.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.This issue affects BA Book Everything: from n/a through 1.6.8.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.This issue affects BA Book Everything: from n/a through 1.6.8.
