A reflected cross-site scripting (XSS) vulnerability exists in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to inject malicious script content into HTML responses that are then viewed by other users, potentially leading to script execution in their browsers.
An improper authorization vulnerability exists in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to make unauthorized changes to the approval state, bypassing intended approval restrictions. The vulnerability has a medium severity rating with a CVSS score of 5.3. No public exploits or patches are currently documented.
Kali Forms versions up to 2.4.27 contain a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability. The issue is identified as CWE-79 and has a CVSS 3.1 base score of 6.5, indicating medium severity.
A stored cross-site scripting (XSS) vulnerability exists in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to inject malicious scripts that execute in the browsers of other users. The vulnerability has a medium severity rating with a CVSS score of 5.1. No public exploits or patches are currently documented.
A path traversal vulnerability exists in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated administrators to read files outside the intended directory, potentially exposing sensitive information. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No public exploits or known active exploitation have been reported. No patch or official remediation details are provided in the available data.
A missing authorization vulnerability exists in the RelyWP Simple Cloudflare Turnstile plugin up to version 1.44.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A missing authorization vulnerability in the WPFunnels Team Product Feed Manager plugin (best-woocommerce-feed) up to version 7.14.1 allows attackers to exploit improperly configured access control security levels. This vulnerability does not require authentication and can lead to unauthorized modification of data or settings, impacting the integrity of the system.
A missing authorization vulnerability exists in Ahmad WP Job Portal (wp-job-portal) up to version 2.7.1. This flaw allows exploitation due to incorrectly configured access control security levels, potentially permitting unauthorized access to certain functions or data.
A server-side request forgery (SSRF) vulnerability exists in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to make server-side requests to internal services and observe response information. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or remediation details are currently provided.
A stored cross-site scripting (XSS) vulnerability exists in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to upload script content that executes in other users' browsers, potentially leading to unauthorized actions or data exposure.
A stored cross-site scripting (XSS) vulnerability exists in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to inject malicious scripts that execute in other users' browsers when they view the affected work-notes. The vulnerability has a medium severity rating with a CVSS score of 5.1. No patch or remediation details are currently provided.
A Stored Cross-site Scripting (XSS) vulnerability exists in CozyThemes Cozy Blocks cozy-addons, affecting versions up to 2.2.27. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
A missing authorization vulnerability exists in Kali Forms (kali-forms) up to version 2.4.27. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to sensitive functionality or data. The vulnerability has a CVSS v3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. No public exploits or known in-the-wild exploitation have been reported. No patch or remediation information is currently available.
A missing authorization vulnerability exists in Crocoblock JetEngine up to version 3.9.0.1. This flaw allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized data disclosure. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. No public exploits or patches are currently documented.
CVE-2026-118084 is an authorization bypass vulnerability in nicdark Hotel Booking versions up to 3.8. It is caused by insecure direct object references (IDOR) that allow a user to bypass authorization controls using a user-controlled key. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with high confidentiality impact but no integrity or availability impact.
CVE-2026-118078 is a high-severity vulnerability in the Product Catalog Feed by PixelYourSite plugin, affecting versions up to 3.1.4. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-116869 is a high-severity vulnerability in myPOS Checkout versions up to 1.4.5. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with high privileges to execute arbitrary code or cause denial of service by manipulating serialized PHP objects.
CVE-2026-62014 is a critical vulnerability in ThemeREX EmojiNation versions up to 1.0.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.