Threat database

CVE-2026-22342 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting PremiumPress Limited's WordPress Dating Theme versions up to and including 11.2.0. This vulnerability allows unauthenticated attackers to perform unauthorized actions by tricking users into submitting unwanted requests. The vulnerability has a CVSS 3.1 base score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet by the vendor.

Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.

A cross-site scripting (XSS) vulnerability exists in Shipment Tracker for Woocommerce versions up to and including 1.5.3.2. This vulnerability allows an attacker with subscriber-level privileges to inject malicious scripts during web page generation. The vulnerability is classified as CWE-79 and has a CVSS 3.1 base score of 6.5, indicating medium severity.

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.

The USR-W610 RS232/485 to Wi-Fi/Ethernet Converter from Jinan USR IOT Technology Limited contains plaintext administrative credentials embedded in its firmware. These credentials can be extracted by analyzing the firmware image, allowing unauthorized authentication to device services. This vulnerability is classified as CWE-798 and has a critical severity with a CVSS score of 9.8. No official patch or remediation guidance is currently available from the vendor. Exploitation could lead to full compromise of confidentiality, integrity, and availability of the device.

The LiveSmart Video Chat Live Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livesmart_widget' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection. This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.

Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a user views a malicious page while logged-in to the affected product, unexpected operations may be done.

Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a file containing malicious contents is uploaded, an arbitrary script may be executed on a user's web browser when viewing the administration page showing the information of the file.

Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allows OS Command Injection. This issue affects SambaBox: from 5.1 before 5.3.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited Company Online Support Application allows Reflected XSS. This issue affects Online Support Application: from V3 through 31122025.

Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Cross Site Request Forgery.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.11.0.

CVE-2026-40356 is an integer underflow vulnerability in MIT Kerberos 5 versions before 1.22.3. It occurs when gss_accept_sec_context() is called on a system with a NegoEx mechanism registered, causing an out-of-bounds read. An unauthenticated remote attacker can trigger this, potentially causing the affected process to terminate unexpectedly. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

CVE-2026-7158 is a server-side request forgery (SSRF) vulnerability in the dmitryglhf mcp-url-downloader project affecting the _validate_url_safe function in src/mcp_url_downloader/server.py. This vulnerability allows remote attackers to manipulate the URL argument, potentially causing the server to make unauthorized requests. The issue has been publicly disclosed, but no official vendor response or patch is currently available. The product uses a rolling release model, so specific affected or fixed versions are not clearly identified. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

Mojic versions prior to 2.1.4 contain a timing side-channel vulnerability in the CipherEngine's HMAC-SHA256 integrity verification. The use of a standard equality operator (! ==) during decryption causes an observable timing discrepancy (CWE-208), which could allow an attacker to bypass the file integrity check via timing analysis. This vulnerability has a medium severity rating and a CVSS score of 4.7. The issue is fixed in version 2.1.4.

KANATA Limited's CMS ALAYA version 7.4.1.4 and earlier contains an SQL injection vulnerability that allows an attacker with administrative interface access to obtain or alter information stored in the database. The vulnerability is classified as medium severity with a CVSS score of 4.7. There is no confirmed patch or official remediation available at this time. Exploits in the wild are not known. Users should verify vendor advisories for updates and consider restricting administrative access to trusted personnel until a fix is available.

The WP Store Locator plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'wpsl_address' post meta value. This vulnerability affects versions up to and including 2.2.261 and allows authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute when any user views the affected page and opens the injected map marker info window. The vulnerability arises from insufficient input sanitization and output escaping. It has a CVSS score of 6.4, indicating a medium severity level.

CVE-2026-35496 is a path traversal vulnerability in CubeCart versions prior to 6.6.0. It allows users with administrative privileges to access directories above the intended restricted directory. The vulnerability has a low severity score and does not affect confidentiality beyond limited information disclosure. There is no confirmed patch or official remediation guidance available at this time.

An SQL injection vulnerability exists in CubeCart versions prior to 6.6.0. This flaw allows an attacker to execute arbitrary SQL statements on the affected product, potentially impacting confidentiality, integrity, and availability. The vulnerability has a CVSS score of 6.3, indicating a medium severity level. There is no explicit vendor advisory or patch information provided in the data. No known exploits are reported in the wild at this time.