Threat database

mall4j versions up to 4.0 have an improper authorization vulnerability due to an operator precedence logic error in the cleanExpiryProdList SQL statement. Authenticated storefront customers can exploit this flaw by sending a DELETE request to /p/shopCart/cleanExpiryProdList, which deletes cart items of other users for off-shelf products. These deleted items do not return when products are restocked. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.

mall4j versions up to 4.0 contain an information disclosure vulnerability due to an operator precedence logic error in the getShopCartExpiryItems SQL filter. Authenticated users can exploit this flaw to access other shoppers' cart items, including product details, SKU, quantity, shop, and promoter card numbers. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3.

CVE-2026-62130 is a high-severity vulnerability in WooCommerce Multilingual & Multicurrency versions up to 5.5.8. It involves PHP Object Injection due to deserialization of untrusted data by users with shop manager privileges. This flaw can lead to full confidentiality, integrity, and availability compromise of the affected system.

CVE-2026-96553 is a reflected cross-site scripting (XSS) vulnerability in the FiboSearch plugin for WooCommerce by Damian Góra. It affects versions from the initial release up to 1.34.1. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that execute in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

CVE-2026-103345 is a medium severity vulnerability in Shamim Rajani's Pie Register plugin that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. It affects versions from initial releases up to 3.8.4.13 inclusive.

CVE-2026-100507 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in If-So Dynamic Content Personalization affecting versions from initial through 1.10.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application.

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.

CVE-2026-102365 is a high-severity vulnerability in gz-yami mall4j up to version 4.0 where authorization checks are missing on certain GET endpoints in the UserAddrController. Authenticated attackers can access endpoints that expose customer address data, including names, phone numbers, and postal information. This allows unauthorized data harvesting of sensitive customer information.

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.

CVE-2026-102361 is a critical vulnerability in gz-yami mall4j versions up to 4.0 that allows unauthenticated attackers to reset any storefront account password via the PUT /user/updatePwd endpoint. This missing authentication flaw enables attackers to specify a target username and overwrite passwords without verification, leading to account takeover and unauthorized access to orders and personal data.

Dozzle versions before 11.1.2 contain a path traversal vulnerability in the log download endpoint. The issue arises because container display names are not properly sanitized when building ZIP archive entry names. This allows attackers who can label containers to craft path traversal sequences that write files outside the intended extraction directory when logs are downloaded and extracted.

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argument itemName leads to cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.

Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment using per-user filters, any authenticated restricted account can receive resource telemetry and lifecycle events for containers outside its authorized label scope. The exposed data includes container names, images, full label maps, CPU and memory use, network and disk totals, and deployment or restart activity across monitored hosts, but does not include log contents, environment values, or exec access. This issue is fixed in version 10.6.7.

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.

Chamilo LMS versions prior to 2.0.1 contain a critical path traversal vulnerability (CWE-22) that allows unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability is fixed in version 2.0.1. The advisory does not specify the affected endpoint or exploitation details. The CVSS score is 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.