Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.15.0.8.

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint /wp-json/booking-package/v1/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.

The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Kite, a Kubernetes dashboard, has a missing authorization vulnerability (CWE-862) in versions prior to 0.12.3. Authenticated users with any role can access cluster overview data for clusters they are not authorized to view by manipulating the x-cluster-name parameter. The vulnerability arises because the overview API endpoint is registered before the RBAC middleware and only verifies that the user has any role, not specific permissions. This issue is fixed in version 0.12.3.

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.

Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.

The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.

CVE-2026-48871 is a high-severity vulnerability in the MW WP Form plugin by Takashi Kitajima, affecting versions up to and including 5.1.3. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks due to improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability of affected systems. No official patch or remediation guidance is currently provided by the vendor.

Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.

WordPress Theme Travelscape version 1.0.3 contains a critical arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload malicious files due to insufficient validation in the theme's upload functionality. Successful exploitation can lead to remote code execution on the affected WordPress installation.

The Booking Package plugin for WordPress has a vulnerability in versions up to and including 1.7.16 that allows privilege escalation via account takeover. This occurs because the 'updateUser' AJAX endpoint lacks proper capability checks, enabling authenticated users with Editor-level access or higher to change the email and password of any account, including administrators. This can lead to a full site takeover.

Kiteworks Secure Data Forms versions prior to 9.3.0 contain multiple SQL Injection vulnerabilities. These can be exploited by an authenticated attacker with the FormBuilder role to access or modify other users' form definitions and some global configuration parameters. The vulnerability is addressed in version 9.3.0 and later.

An Insecure Direct Object Reference (IDOR) vulnerability exists in kiteworks Secure Data Forms prior to version 9.3.0. This vulnerability allows an authenticated user to access metadata of resources owned by other users due to insufficient authorization checks. The issue is resolved by upgrading to version 9.3.0 or later.

An authorization bypass vulnerability (CWE-639) exists in Kiteworks Secure Data Forms prior to version 9.3.0. This Insecure Direct Object Reference (IDOR) flaw allows an authenticated user to modify resources owned by other users due to insufficient authorization checks. The vulnerability has a medium severity with a CVSS score of 4.3. Upgrading to version 9.3.0 or later addresses this issue.

An Insecure Direct Object Reference (IDOR) vulnerability exists in kiteworks Secure Data Forms prior to version 9.3.0. This vulnerability allows an authenticated user to modify permissions on resources owned by other users due to insufficient authorization checks. The issue is resolved by upgrading to version 9.3.0 or later.