Threat database

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.

CVE-2026-109893 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force Presto Player affecting versions before 4.5.4. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with low privileges and user interaction to execute malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-105874 is a high-severity reflected cross-site scripting (XSS) vulnerability in Brainstorm Force SureCart versions prior to 4.9.4. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application.

CVE-2026-106599 is a high-severity vulnerability in Brainstorm Force SureCart affecting versions from initial release up to 4.9.3. It involves deserialization of untrusted data, allowing object injection. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system. No specific patch or remediation details are provided in the available data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.

Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.

Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

The ConvertPlus WordPress plugin up to version 3.6.3 contains a vulnerability involving deserialization of untrusted data via an AJAX action parameter. This flaw allows authenticated users with Subscriber-level access or higher to inject a PHP object if a gadget chain is available in other installed plugins or themes. The vulnerability arises from insufficient nonce validation, lack of capability checks, and improper sanitization that permits shortcode injection leading to unsafe unserialization. Exploitation depends on the presence of a POP chain in additional installed components. The vulnerability has a high severity rating with a CVSS score of 8.8.

Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.

Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.

CVE-2026-80433 is a high severity vulnerability in Brainstorm Force's SureFeedback Client Site versions up to 1.2.12. It involves missing authorization controls that lead to exposure of subscriber sensitive data. The vulnerability does not require user interaction or privileges to exploit and has a network attack vector. No official patch or remediation guidance is currently available.

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.