Archive
20 September 2026
Vulnerabilities first published on this day (UTC), newest first.
107 results · Feed
-
High 8.5
Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and…
-
High 7.5
Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the…
-
Medium 6.8
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and r…
-
High 7.5
Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level ac…
-
High 8.1
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an at…
-
Medium 4.2
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any…
-
Low 3.1
NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change set…
-
Medium 4.1
Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
-
Medium 6.8
Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Script…
-
Low 2.7
NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any imag…
-
Low 3.1
NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on t…
-
High 7.2
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users gra…
-
Medium 4.7
aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection
A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_tasks.py of the component TASK_RUN_COMMAND. Such manipulation of the argument command lea…
-
Medium 6.6
aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection
A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. …
-
Medium 5.3
NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authent…
-
Medium 6.3
itsourcecode Leave Management System controller.php sql injection
A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipulation of the argument DEPTID leads to sql injection. The attack can be initiated…
-
High 8.3
Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow
A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffe…
-
Medium 5.3
Dromara UJCMS UserController UserController.java usernameExist improper authorization
A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation…
-
High 8.8
A password reset vulnerability in ZTE SmartLife APP
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv …
-
Medium 5.4CVE-2026-86552 Public exploit
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via …
-
Medium 4.3
Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication
A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authenticatio…
-
High 7.3
SourceCodester Online Reviewer Management System btn_functions.php sql injection
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_functions.php. This manipulation of the argument Course causes sql injecti…
-
Low 3.3
Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product
The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.
-
Critical 9.4
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.…
-
Critical 9.4
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 stat…
-
Critical 9.1CVE-2026-93958 Public exploit
D-Link R95 DHMAPI ssi system os command injection
A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotel…
-
Medium 4.3
olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison
A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitatio…