Threat database

CVE-2026-62115 is a high severity vulnerability in KuteShop versions up to and including 4.2.9. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements, classified under CWE-98. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62100 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in KuteShop versions up to and including 4.2.9. This vulnerability allows an attacker to inject malicious scripts during web page generation without requiring authentication. The flaw is categorized under CWE-79, indicating improper neutralization of input. No patch or remediation information is currently provided by the vendor.

CVE-2026-62099 is a high-severity vulnerability in the Boutique product by kutethemes, affecting versions up to and including 2.3.3. It involves an unauthenticated local file inclusion (LFI) due to improper control of filenames in include/require statements in PHP, classified under CWE-98. This flaw allows an attacker to include files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-62098 is a medium severity vulnerability in kutethemes Boutique versions up to 2.3.3 that allows unauthenticated content injection due to improper control of code generation (CWE-94). This vulnerability could lead to limited confidentiality and integrity impacts without affecting availability. No patch or remediation information is currently provided.

CVE-2026-62096 is a high-severity vulnerability in kutethemes Biolife versions up to and including 3.2.3. It involves an unauthenticated Local File Inclusion (LFI) flaw, categorized under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-62095 is a high-severity vulnerability in kutethemes Biolife versions up to and including 3.2.3. It is an unauthenticated cross-site scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-62094 is a high-severity vulnerability in kutethemes TechOne versions up to and including 3.0.3. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability allows an attacker to potentially include and execute arbitrary files on the server, impacting confidentiality, integrity, and availability.

CVE-2026-62093 is a high-severity vulnerability in kutethemes TechOne versions up to and including 3.0.3. It is an unauthenticated cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-62092 is a high-severity vulnerability in kutethemes Armania versions up to 1.4.8 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote code execution or full system compromise if exploited.

CVE-2026-62091 is a high severity unauthenticated cross-site scripting (XSS) vulnerability affecting kutethemes Armania versions up to and including 1.4.8. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is currently provided.

CVE-2026-48194 is a high-severity vulnerability in kutethemes DukaMarket versions up to 1.3.0. It involves an unauthenticated Local File Inclusion (LFI) due to improper control of filenames in include/require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to remote code execution or full system compromise.

CVE-2026-48193 is a high severity vulnerability in kutethemes Uminex versions up to and including 1.0.9. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include or require statements in PHP. This flaw could allow an attacker to include and execute arbitrary local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affects Uminex: from n/a through <= 1.0.9.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issue affects DukaMarket: from n/a through <= 1.3.0.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affects Armania: from n/a through <= 1.4.8.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affects TechOne: from n/a through <= 3.0.3.

Missing Authorization vulnerability in kutethemes Biolife biolife allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Biolife: from n/a through <= 3.2.3.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP Local File Inclusion.This issue affects Biolife: from n/a through <= 3.2.3.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allows PHP Local File Inclusion.This issue affects Boutique: from n/a through <= 2.3.3.

Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KuteShop: from n/a through <= 4.2.9.