Threat database

CVE-2026-109892 is a critical vulnerability in Frontend Admin by DynamiApps (Shabti Kaplan) that allows incorrect privilege assignment leading to privilege escalation. It affects versions from 0 up to and including 3.29.13. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-42722 is a high-severity SQL Injection vulnerability affecting Frontend Admin by DynamiApps versions up to and including 3.29.13. The flaw allows an administrator-level user to inject SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and limited availability impact but does not affect integrity. No public exploits are known, and no patch information is currently available.

Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

CVE-2026-66662 is a critical vulnerability in Frontend Admin by DynamiApps versions up to and including 3.29.10. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment (CWE-266). The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-66470 is a high-severity vulnerability in Frontend Admin by DynamiApps (Shabti Kaplan) versions up to and including 3.29.10. It involves missing authorization controls (CWE-862), allowing subscribers to bypass intended access restrictions. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high impact primarily due to integrity loss and high availability impact. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Blind SQL Injection.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.3.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Path Traversal.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Reflected XSS.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.25.17.