DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity by interacting with the application's local service without any pairing confirmation or user interaction. Attackers can exploit the unauthenticated local service through same-device loopback to perform privileged SMS operations using the victim application's permissions.
CVE-2026-46690 is a medium severity vulnerability in the spearman unbounded-spsc queue library versions 0.2.0 and earlier. It involves an out-of-bounds read caused by a pointer-as-value transmute operation in the sender::send function, which can lead to a fake-Arc drop during concurrent transmit/receive races. No patches or official fixes are available at the time of publication.
The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. Specifically, in the sherkcptdisplays_func() function in includes/SherkCPTDisplaysShortcode.php, the 'title' attribute value is extracted from shortcode_atts() on line 19 and directly concatenated into an HTML <h2> tag on line 31 without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-25241 is a critical SQL injection vulnerability in the PEAR pearweb framework affecting versions prior to 1.33.0. It allows unauthenticated remote attackers to execute arbitrary SQL commands via the /get/<package>/<version> endpoint by manipulating the package version parameter. This vulnerability does not require authentication or user interaction and can lead to full compromise of the backend database, impacting confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the high CVSS score of 9.3 reflects the severe risk. European organizations using pearweb in their PHP environments should urgently update to version 1.33.0 or later.
CVE-2026-25240 is a medium-severity SQL injection vulnerability affecting pearweb versions prior to 1.33.0. The flaw arises in the user::maintains() function when role filters are passed as an array and interpolated unsafely into an SQL IN clause, allowing attackers to manipulate queries. No authentication or user interaction is required, and exploitation can lead to limited data integrity impacts. The vulnerability has been patched in version 1.33.0. There are no known exploits in the wild yet. European organizations using pearweb in their PHP environments should prioritize updating to the fixed version to prevent potential exploitation.
CVE-2026-25239 is a high-severity SQL injection vulnerability in the PEAR pearweb component prior to version 1.33.0. It arises from improper neutralization of special elements in SQL commands during the insertion of filenames into an API documentation queue. An unauthenticated attacker can manipulate the filename parameter to execute arbitrary SQL queries, potentially compromising data integrity and confidentiality. The vulnerability has been patched in version 1.33.0. No known exploits are currently reported in the wild. European organizations using pearweb versions before 1.
CVE-2026-25238 is a critical SQL injection vulnerability in the PEAR pearweb component prior to version 1.33.0. It arises from improper neutralization of special elements in SQL commands during bug subscription deletion, allowing attackers to inject malicious SQL via a crafted email parameter. The vulnerability requires no authentication or user interaction and can lead to high confidentiality, integrity, and availability impacts. Although no known exploits are currently reported in the wild, the high CVSS score (9.2) indicates severe risk. The issue has been patched in version 1.33.0, and affected organizations should upgrade immediately.
CVE-2026-25237 is a critical vulnerability in pearweb, a component of the PEAR PHP framework, affecting versions prior to 1.33.0. It arises from the use of preg_replace() with the deprecated /e modifier, which allows attacker-controlled input to be evaluated as PHP code during bug update email handling. This leads to remote code execution without requiring authentication or user interaction. The vulnerability has a CVSS 4.0 score of 9.2, indicating high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and severity make it a significant threat. European organizations using pearweb in their PHP environments are at risk, especially those in sectors relying on legacy PHP components.
CVE-2026-25236 is a medium-severity SQL injection vulnerability affecting pearweb versions prior to 1.33.0. The flaw arises from improper neutralization of special elements in SQL commands, specifically unsafe literal substitution in karma queries for an IN (... ) list. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL queries remotely without user interaction, potentially leading to limited data integrity impact. The issue has been patched in version 1.33.0. Although no known exploits are currently reported in the wild, organizations using vulnerable pearweb versions should prioritize updating to mitigate risk.
CVE-2026-25235 is a high-severity vulnerability in the PEAR pearweb PHP framework prior to version 1.33.0. It involves a predictable seed in the pseudo-random number generator used to create verification hashes, allowing attackers to guess verification tokens. This flaw can enable unauthorized verification of election account requests, potentially compromising account integrity. The vulnerability requires no user interaction and can be exploited remotely without authentication. It has a CVSS 4.0 score of 8.2, indicating a significant risk. Although no known exploits are currently in the wild, the issue has been patched in version 1.
CVE-2026-25234 is a medium severity SQL injection vulnerability in the PEAR pearweb framework prior to version 1.33.0. It allows an attacker with access to the category manager workflow to inject malicious SQL commands via a category ID parameter. Exploitation does not require user interaction but does require limited privileges (category manager access). The vulnerability impacts confidentiality and integrity by enabling unauthorized database queries or modifications. No known exploits are currently reported in the wild. The issue has been patched in version 1.33.0, and upgrading is strongly recommended.
CVE-2026-25233 is a high-severity logic vulnerability in the PEAR pearweb system affecting versions prior to 1.33.0. The flaw is an operator precedence logic error in the roadmap role check, which allows non-lead maintainers to create, update, or delete roadmaps without proper authorization. This vulnerability does not require user interaction or elevated privileges beyond maintainer access and can be exploited remotely over the network. Although no known exploits are currently in the wild, the issue impacts the integrity of project management data within pearweb. The vulnerability has been patched in version 1.33.0, and organizations using affected versions should upgrade promptly. European organizations relying on PEAR components for PHP development or project management are at risk, especially those with active development teams using pearweb.
The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database.
The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.
The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SherkSpear Add Ribbon Shortcode add-ribbon allows DOM-Based XSS.This issue affects Add Ribbon Shortcode: from n/a through <= 1.0.1.
The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX functions in combination with nonce leakage in all versions up to, and including, 5.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain certain sensitive information related to plugin settings.
The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpa_check_authentication' function in all versions up to, and including, 5.2.1. This makes it possible for unauthenticated attackers to modify the site's Google Analytics tracking ID.
CVE-2020-36193 is a directory traversal vulnerability in the PEAR Archive_Tar package's Tar.php script. It allows remote attackers to perform write operations outside the intended directory by exploiting inadequate symbolic link checks, potentially modifying arbitrary files. The vulnerability affects PHP components used in third-party products such as Drupal Core and Red Hat Linux. Red Hat has provided advisories but no patches for end-of-life PHP versions 7.2 and 7.3. Exploitation in the wild has been observed.
CVE-2020-28949 is a vulnerability in the PEAR Archive_Tar PHP package that allows a local authenticated attacker to bypass security restrictions via a stream-wrapper attack. This flaw enables overwriting arbitrary files on the system using a specially crafted tar archive. The vulnerability arises because the package blocks the 'phar:' stream wrapper but not 'PHAR:', leading to improper filename sanitization. PHP versions 7.2, 7.3, and 7.4 are deprecated, and no patches are planned for php-pear. Red Hat has analyzed affected products and may release fixes or mitigations depending on the product lifecycle and impact. Exploits are known in the wild.
