Kiteworks Secure Data Forms versions prior to 9.3.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows an authenticated attacker to inject and execute arbitrary JavaScript code in other users' sessions. The vulnerability is fixed in version 9.3.0 and later.
Kiteworks Secure Data Forms prior to version 9.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to modify resources owned by other users due to insufficient authorization checks. This vulnerability is addressed in version 9.3.0 and later.
A reflected cross-site scripting (XSS) vulnerability exists in kiteworks Secure Data Forms prior to version 9.3.0. This vulnerability allows an external attacker to trick a user into executing arbitrary JavaScript code. The issue is fixed in version 9.3.0 and later.
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
An authorization bypass vulnerability (CWE-639) exists in Kiteworks Secure Data Forms versions prior to 9.3.0. This Insecure Direct Object Reference (IDOR) flaw allows an authenticated attacker to manipulate approval flow configurations of forms owned by other users due to insufficient authorization checks. The vulnerability has a CVSS score of 6.5 (medium severity). No known exploits are reported in the wild. Users should upgrade to version 9.3.0 or later to address this issue.
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.
The Booking Package plugin for WordPress up to version 1.7.06 contains a vulnerability allowing unauthenticated attackers to manipulate booking prices by altering the amount parameter sent to the Stripe PaymentIntent API. The plugin fails to validate or enforce the server-calculated booking cost during payment confirmation, enabling attackers to pay arbitrary amounts, potentially much lower than the actual service cost. This issue arises because the critical code that would update the PaymentIntent with the correct amount is commented out. The vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter) and has a CVSS score of 5.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor.
A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the component StringStorage Template Handler. This manipulation causes improper neutralization of directives in dynamically evaluated code. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting. Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser — but provides no equivalent protection for outgoing response headers in the encoder. This issue has been patched in version 3.0.6.
BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Browsing Target GET_FOLDER_ITEMS handler that fails to validate packet boundaries and attribute count data. An attacker with a paired Bluetooth Classic connection can exploit insufficient bounds checking on the attr_id parameter to cause crashes and corrupt attribute bitmap state.
BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers that allows nearby attackers to read beyond packet boundaries. Attackers can establish a paired Bluetooth Classic connection and send specially crafted VENDOR_DEPENDENT responses to trigger out-of-bounds reads, causing information disclosure and potential crashes on affected devices.
BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers that allows attackers to read beyond buffer boundaries. A nearby attacker with a paired Bluetooth Classic connection can send a specially crafted VENDOR_DEPENDENT response with an attacker-controlled count value to trigger an out-of-bounds read from the L2CAP receive buffer, potentially causing a crash on resource-constrained devices.
Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
CVE-2026-23636 is a medium severity vulnerability in Kiteworks Secure Data Forms prior to version 9.2.1. It involves an unrestricted upload of files with dangerous types due to missing validation, which could be exploited by a form manager. This vulnerability can lead to integrity impact but does not affect confidentiality. A patch is available in Kiteworks version 9.2.1 and later.
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to receive a patch.
CVE-2026-32881 affects the Gleam web server 'ewe' versions 0.6.0 through 3.0.4 and allows attackers to bypass authentication or spoof proxy-trust headers by exploiting permissive handling of chunked transfer encoding trailers. The vulnerability arises because only a limited denylist of nine header names is blocked when merging trailer headers into the request headers after body parsing. Malicious clients can append headers in the Trailer field after the final chunk, causing legitimate headers to be overwritten. This enables forging authentication credentials, session hijacking, bypassing IP-based rate limiting, or spoofing proxy-trust headers in downstream middleware that reads headers post body parsing. The issue is fixed in version 3.0.
CVE-2026-32873 is a high-severity vulnerability in the Gleam web server 'ewe' versions 0.8.0 through 3.0.4. The flaw exists in the handle_trailers function, where rejected trailer headers cause an infinite recursion loop, leading to 100% CPU usage and a denial-of-service condition. This occurs because the function repeatedly re-parses the same header without advancing, permanently wedging the BEAM process. Exploitation requires no authentication or user interaction and can be triggered remotely via chunked HTTP requests. The vulnerability is fixed in version 3.0.
Location Aware Sensor System by Linkit ONE, up to commit f06bd20 (2023-04-26), contains a reflected cross-site scripting vulnerability in the PM25.php file that allows remote attackers to execute arbitrary JavaScript by injecting malicious code into GET parameters. Attackers can craft a malicious URL containing unencoded payloads in the site, city, district, channel, or apikey parameters to execute scripts in victims' browsers when they visit the page.