The Photo Gallery by 10Web WordPress plugin versions before 1.8.49 contains a vulnerability where a shortcode attribute that sets a gallery watermark image is not properly escaped before rendering into an HTML image attribute. This flaw allows users with Contributor-level access and above to perform Stored Cross-Site Scripting (XSS) attacks that execute in the browsers of any users viewing the published gallery, including administrators.
The Defender Security WordPress plugin versions before 6.4.1 do not limit the number of failed two-factor authentication attempts by default. This allows an attacker who already knows a user's password to brute-force the one-time authentication code, potentially bypassing the second factor of authentication.
The WP Directory Kit WordPress plugin versions before 1.6.3 contain a vulnerability where a parameter used to order results on an admin screen is not properly sanitized or escaped. This flaw allows users with the custom Listing Admin role or higher to perform SQL injection attacks by bypassing the plugin's keyword deny-list filtering.
A vulnerability in the synomount component of Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files. This issue involves external control of system or configuration settings. The vulnerability has a medium severity with a CVSS score of 4.3 and does not impact confidentiality or availability but impacts integrity.
A vulnerability in Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files due to improper neutralization of input during web page generation in the DSMNotify component.
A server-side request forgery (SSRF) vulnerability exists in the Credential API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to read specific files on the affected system. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploit or known active exploitation is reported. No patch links are provided in the data, and the vendor advisory status is not confirmed.
A vulnerability in Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files due to improper limitation of pathname to a restricted directory in the contentextract component.
A missing authorization vulnerability exists in the Promotion API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A vulnerability in Synology DiskStation Manager (DSM) SNMP API before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated administrators to read or write arbitrary files and perform denial-of-service attacks due to improper neutralization of CRLF sequences.
A vulnerability in the authentication API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and perform denial-of-service attacks. This flaw is due to a missing critical step in the authentication process.
A vulnerability in the API framework of Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files by inserting sensitive information into sent data. This issue affects the confidentiality of data but does not impact integrity or availability.
A critical SQL injection vulnerability exists in the Auth API of Synology DiskStation Manager (DSM) versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw allows remote attackers to read or write arbitrary files and perform denial-of-service attacks without requiring authentication.
A missing authorization vulnerability exists in the TaskScheduler API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A reachable assertion vulnerability exists in the synoscgi component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This vulnerability allows remote attackers to cause limited denial-of-service (DoS) conditions by triggering the assertion failure. The vulnerability does not impact confidentiality or integrity but affects availability.
A missing authorization vulnerability exists in the ACL API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to read or write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 5.4.
A missing authorization vulnerability exists in the SocketIo API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.3, indicating limited impact primarily on integrity. No public exploits or known active exploitation have been reported. No explicit patch information is provided in the source data.
CVE-2026-75785 is a vulnerability in the VPN API of Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of special elements used in OS commands, allowing remote authenticated administrators to read or write arbitrary files and perform denial-of-service attacks.
A vulnerability in Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and cause denial-of-service via improper link resolution before file access in the thumb component.
A vulnerability in Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers controlling a compromised LDAP or Active Directory server to exploit improper neutralization of special elements in SQL commands. This can lead to arbitrary file read/write and denial-of-service conditions.
An uninitialized pointer vulnerability exists in the nfsd component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers to cause a denial-of-service (DoS) condition by exploiting the improper handling of uninitialized pointers.