Search: 7.3.1.1

Doofinder for WooCommerce versions up to 2.17.2 contain a vulnerability that allows insertion of sensitive information into files or directories accessible externally. This flaw can lead to unauthorized retrieval of embedded sensitive data. The vulnerability is identified as CWE-538 and has a high severity with a CVSS score of 7.5.

Herowatch Go Server by About Time Technologies has an Insecure Direct Object Reference (IDOR) vulnerability allowing authenticated remote attackers to modify parameters to access or manipulate other users' data and functions. This vulnerability has a CVSS score of 7.5, indicating high severity. No affected versions or patches are specified in the available data.

IRISPowerscan contains an insecure default configuration where the built-in installation account has elevated privileges and a predictable password. This vulnerability allows an unauthenticated attacker to gain unauthorized access to privileged application functionality. The issue affects versions from 0 up to and including 12.3. The CVSS 4.0 base score is 7.2, indicating a high severity vulnerability.

IRISPowerscan contains default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate and access application functionality, potentially leading to unauthorized access or modification of data and configuration. The vulnerability affects versions from 0 up to and including 12.3. The CVSS 4.0 score is 7.2, indicating a high severity level.

A path traversal vulnerability (CWE-22) exists in TÜBİTAK BİLGEM Software Technologies Research Institute's İmzager software versions from 2.10.5 up to but not including 2.10.7. This flaw allows unauthorized path traversal, potentially leading to limited integrity impact. The issue is fixed in version 2.10.7.

CVE-2026-19721 is an XML External Entity (XXE) vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute's İmzager software. It affects versions from 2.10.5 up to but not including 2.10.7. The flaw allows improper restriction of XML external entity references, enabling serialized data external linking. The vulnerability has a low CVSS score of 3.3 and does not impact confidentiality or availability but may affect integrity. A fix is available in version 2.10.7.

A stored cross-site scripting (XSS) vulnerability exists in the wpDiscuz plugin for WordPress, affecting versions prior to 7.6.74. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a high severity rating and is fixed in version 7.6.74.

The FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212 have an authorization flaw in a video-migration function. This function relies solely on a nonce for protection, which is insufficient. As a result, users with Contributor-level permissions or higher can disclose and bulk-modify stored video records across the entire site.

The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.

The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.

The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.

A use-after-free vulnerability in Ashlar-Vellum Cobalt XE file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity rating of 7.8 assigned by ZDI.

A command injection vulnerability exists in Qihoo 360 D603-2, D600-2, and D606-6 devices up to version 6.3.2. The flaw is in the on_push_message function of the /fs2/bin/iscm component's Timezone Push Handler, where manipulation of the tz argument can lead to remote OS command injection. This vulnerability has a CVSS score of 7.3 (high severity). The issue is resolved by upgrading to version 6.4.0, which implements a validation check for the timezone parameter.