Threat database

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.

Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

Atlassian's October 2026 security bulletin addresses 75 unique vulnerabilities affecting its Data Center and Server products, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. Among these, 14 are critical-severity issues primarily in third-party components such as Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD. Atlassian assesses the risk from these third-party component vulnerabilities as lower and non-critical for their products. The bulletin includes a variety of issues such as denial-of-service, cryptographic weaknesses, authentication and authorization problems, SSRF, information disclosure, and code execution bugs. Atlassian recommends updating to the latest product versions or fixed releases to mitigate these vulnerabilities. There is no indication of active exploitation in the wild for these issues.

CVE-2026-4952 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (AuftragsManager) version 7.0.8.6 and earlier. Authenticated users can inject JavaScript code into a business reference field via the ASMobile web interface. This code executes when a privileged user views the order in the OrderAdministration portal, potentially leading to privilege escalation or session compromise. The vulnerability has a medium severity score of 5.1 and affects versions up to 7.0.8.6. No patch or remediation information is provided by the vendor.

CVE-2026-4951 is a cross-site scripting (XSS) vulnerability in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem. It allows an attacker to inject JavaScript code via the "searchValue" URL parameter, which executes in the browser of a privileged user who opens a crafted link. This can lead to account takeover or user lockout since administrative users can change passwords without needing the old password. Version 7.0.8.6 and earlier versions are affected. The vulnerability has a medium severity score of 5.1. No patch or remediation information is currently available from the vendor.

CVE-2026-4950 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) portal. Privileged users can inject JavaScript code into user properties such as the "secondName" parameter. This code is stored and executed in the browsers of other privileged users viewing the affected user entries or user group overviews. The vulnerability affects versions from 0 up to and including 7.0.8.6. It requires authenticated access with high privileges and user interaction to trigger. No patch or remediation information is provided by the vendor.

CVE-2026-63244 is a critical authentication bypass vulnerability in WizLearn Technologies' Learning Management System. It allows an unauthenticated remote attacker to bypass both password and OAuth authentication by sending a specially crafted POST request. Successful exploitation could lead to unauthorized access to user accounts and full administrative control of the LMS platform.

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

An attacker URL (http://en2an.top/cleanfda/init.sh) was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-23. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen twice in attacker activity originating from infrastructure in China. This URL is linked to attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions or CVEs are associated with this indicator. No known exploits or threat actors have been confirmed in connection with this URL.

CVE-2026-63243 is an authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana devices (V2, V2X, SE). This flaw allows an attacker within Bluetooth range to connect to the affected device without prior pairing or authentication. The vulnerability affects version 1.30.260813.1100 of the product. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with low attack complexity and no user interaction required. There is no indication of a patch or vendor advisory specifying remediation status. No known exploits are reported in the wild.

CVE-2026-55981 is a critical firmware verification vulnerability affecting Creative Labs Creative Sound Blaster Katana V2, V2X, and SE devices. The flaw allows an attacker to modify a legitimate firmware image and upload the altered firmware to the device without proper verification. This can lead to complete compromise of the device's confidentiality, integrity, and availability.

The Iranian state-sponsored APT group known as Prince of Persia resumed operations in 2026 after a three-month pause coinciding with the Iran-US-Israel conflict. The group deployed a new Tornado malware command-and-control (C&C) server hosted in the United States for the first time since 2016, using shared hosting services rather than virtual private servers. Prince of Persia targets Iranian dissidents and government and private entities in the US, Europe, and the Middle East. The group uses malware capable of stealing files via Telegram bots. Semperis researchers have shared indicators of compromise and recommend monitoring for related activity.

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.