Archive
2 May 2026
Vulnerabilities first published on this day (UTC), newest first.
82 results · Feed
-
Low 3.7CVE-2026-7671 Public exploit
CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication
A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may …
-
High 7.3
Jinher OA UserSel.aspx sql injection
A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. This manipulation of the argument DeptIDList causes sql injection. The attack is possible to be carried out remotely. Th…
-
Medium 5.6CVE-2026-7669 Public exploit
sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection
A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote…
-
High 7.3
MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds
A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the component SCEP Endpoint. The manipulation of the argument transactionID/messageType leads to out-of-…
-
Medium 6.3
r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection
A security flaw has been discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4. Affected is the function open_image_in_browser of the file src/index.ts of the component MCP Interface. Performing a manipulation of the argument imageUrl results in os comman…
-
Medium 6.5
ruvnet sublinear-time-solver MCP server.js export_state path traversal
A vulnerability was found in ruvnet sublinear-time-solver 1.5.0. Affected by this vulnerability is the function export_state of the file src/consciousness-explorer/mcp/server.js of the component MCP Interface. The manipulation results in path traversal. The a…
-
High 7.3
ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization
A vulnerability has been found in ChatGPTNextWeb NextChat up to 2.16.1. Affected is the function addMcpServer of the file app/mcp/actions.ts. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been…
-
Medium 4.3
ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be la…
-
Medium 6.3
pskill9 website-downloader MCP index.ts download_website os command injection
A vulnerability was detected in pskill9 website-downloader up to 0.1.0. This affects the function download_website of the file src/index.ts of the component MCP Interface. Performing a manipulation of the argument outputPath results in os command injection. T…
-
Medium 6.5
Totolink N300RH cstecgi.cgi setUploadSetting file inclusion
A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. Th…
-
High 7.3
code-projects Online Hospital Management System viewappointment.php sql injection
A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out re…
-
Medium 5.4
code-projects Online Hospital Management System Registration improper authorization
A vulnerability was found in code-projects Online Hospital Management System 1.0. The impacted element is an unknown function of the component Registration Handler. The manipulation of the argument Username results in improper authorization. The attack can be…
-
Medium 6.4
NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwcty_current_date' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and outpu…
-
Medium 5.3
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.1 via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. This is due to the '…
-
High 8.1
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to mis…
-
High 7.3
innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication
A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads …
-
Medium 6.3
kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injection
A flaw has been found in kleneway awesome-cursor-mpc-server up to 2.0.1. Impacted is the function runCodeReviewTool of the file src/tools/codeReview.ts of the component Ccode-Review Tool. Executing a manipulation can lead to command injection. The attack may …
-
Medium 6.3
crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection
A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of the component RepoMix Command Handler. Performing a manipulation results in command injection. The …
-
Unscored —
Null-pointer dereference and double-free via safe APIs
Two soundness violations exist in the Rust bindings for MetaCall: **Null-pointer dereference:** `MetaCallFuture::new_raw()` accepts a raw pointer without validation. The `Debug` impl calls `Box::from_raw(self.data)` on it. Passing a null pointer causes the `D…
-
Unscored —
Invalid pointer arithmetic in `iter()` and `iter_mut()`
The `iter()` and `iter_mut()` APIs compute `current = (&children[0] as *const *const RawAutoChild).sub(1)`, which performs pointer subtraction going before the start of the allocation. This is undefined behavior per Rust's pointer arithmetic rules. This can b…
-
Unscored —
Double-free in `Chomp::inner()`
`Chomp::inner()` uses `std::ptr::read_unaligned` to move out the value from a raw pointer. If the original value is an owned type (e.g. `Box`), calling `inner()` moves out the ownership, but the original variable will still be dropped at the end of its scope.…
-
Unscored —
Out-of-bounds read/write in `Index` and `IndexMut` implementations
The `Index` and `IndexMut` implementations for `Caja` use unchecked pointer arithmetic without bounds validation. Creating a `Caja` with a small key and then accessing an out-of-range index causes out-of-bounds reads or writes beyond the allocated memory. Thi…
-
Unscored —
Buffer overflow in `Clusterings::from_i32_column_major_order()`
The `from_i32_column_major_order` method can create inconsistent internal state. When `labels` length and `n_items` mismatch, `n_clusterings` becomes `labels.len() / n_items` (truncated), but subsequent calls to `label()` use indices that exceed the internal …
-
Unscored —
Double-free and use-after-free in `Keys::next()`
`Keys::next()` uses `ptr::read` to move out the `Option<V>` by value, which drops the contained `V` when `V` is non-Copy (e.g. `String`). This leaves a dangling value in the map's storage slot. Subsequent `get()` operations on that key return a dangling refer…
-
Unscored —
Integer overflow in `array::ReadWrite::new()` leading to potential memory corruption
In `array::ReadWrite::new()` (line 83 of `accessor/src/array.rs`), `let bytes = mem::size_of::<T>() * len` can overflow `usize` when `len` is very large. In release mode, this silently wraps, potentially making `bytes = 0`. The mapper then maps with 0 bytes, …
-
Unscored —
Out-of-bounds read in `bytes_helper` public safe functions
The `bytes_helper` module contains multiple public functions (`into_arr4()`, `into_arr2()`, `u8_from_le_bytes()`) that use `slice.get_unchecked(pos..pos + N)` without verifying that `pos + N <= slice.len()`. These are public safe API functions, allowing any c…
-
Medium 5.5
NULL Pointer Dereference in Wireshark
IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.4
-
Medium 5.8
Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'
The Quiz Maker by AYS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rate_reason' parameter in all versions up to, and including, 6.7.1.29 due to insufficient input sanitization and output escaping. This makes it possible for unaut…
-
High 7.5
Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored v…
-
Medium 5.4
Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter
The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_svg' parameter in versions up to, and including, 4.11.70 due to insufficient input sanitization and out…
-
High 7.5
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack…
-
High 7.5
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes…
-
High 7.5
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
-
High 7.1
Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption
The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the `wp_ajax_pmpro_stripe_create_w…
-
Medium 6.3
8nite metatrader-4-mcp sync_ea_from_file index.ts CallToolRequestSchema path traversal
A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0. This vulnerability affects the function CallToolRequestSchema of the file src/index.ts of the component sync_ea_from_file. Such manipulation of the argument ea_name leads to path trav…
-
Medium 4.7
itsourcecode Courier Management System edit_user.php sql injection
A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The explo…
-
Low 3.7
TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity
A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B01. This impacts the function platform_do_upgrade_cameo_dev of the file cameo_dev.sh of the component Firmware Update Handler. Performing a manipulation results in insufficient verification of data a…
-
Medium 5.4
Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute
The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering the_title() inside HTML attribute context in the home blog section template. …
-
Low 3.7
TRENDnet TEW-821DAP Firmware Update ssi cleartext transmission
A vulnerability has been found in TRENDnet TEW-821DAP 1.12B01. This affects an unknown function of the file /www/cgi/ssi of the component Firmware Update. Such manipulation leads to cleartext transmission of sensitive information. The attack can be executed r…
-
High 8.1
Zyosoft｜School App - Insecure Direct Object Reference
School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify a specific parameter to read and modify other users' data.