Threat database

CVE-2026-97309 is a Missing Authorization vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. This flaw allows unauthorized retrieval of embedded sensitive data. The vulnerability affects versions from initial releases up to 4.1226. It has a high severity score of 7.1 under CVSS 4.0. No patch or official remediation information is provided in the available data.

CVE-2026-100509 is a stored cross-site scripting (XSS) vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. It affects versions from the initial release up to, but not including, 4.1227. The CVSS 3.1 score is 6.5, indicating a medium severity level. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.

CVE-2026-78291 is a medium severity vulnerability in Webful Creations RepairBuddy affecting versions up to 4.1223. It involves unauthenticated broken access control, classified under CWE-862, allowing unauthorized users to perform actions without proper authorization.

CVE-2026-39584 is a medium severity vulnerability in Webful Creations' RepairBuddy product, affecting versions up to and including 4.1132. It involves missing authorization controls (CWE-862), specifically a subscriber broken access control issue. The vulnerability allows an attacker with low privileges to access subscriber-level resources without proper authorization. No official patch or remediation guidance is currently available from the vendor.

Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RepairBuddy: from n/a through 4.1121.