Export limit exceeded: 414622 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414622 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120547 | 2 Saadiqbal, Wordpress-extensions | 2 Cf7 Apps – Addons For Contact Form 7 (honeypot, Database, Redirection, Webhook, Etc.), Cf7 Apps | 2026-11-15 | 4.4 Medium |
| The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only a meaningful privilege escalation on multisite installations or those with DISALLOW_UNFILTERED_HTML enabled, as Editor-level users on default single-site installs already possess the unfiltered_html capability. | ||||
| CVE-2026-125055 | 2 Sameh101, Wordpress-extensions | 2 Chatterbug Forms – Fast, Flexible Wordpress Form Builder, Chatterbug Forms | 2026-11-15 | 9.8 Critical |
| The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier. | ||||
| CVE-2026-125409 | 2 Wordpress-extensions, Wpchill | 2 Passster, Passster – Password Protect Pages And Content | 2026-11-15 | 6.4 Medium |
| The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passster_id | passster_headline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor can break out of the shortcode attribute context by embedding a ] character in the passster_id or passster_headline meta value to prematurely close the opening shortcode tag, then append a [/passster] closing tag so that the trailing HTML payload is emitted verbatim by do_shortcode() — bypassing the per-attribute escaping present inside render_shortcode() — and the script will also execute in an editor's or administrator's browser when they preview the Contributor's pending post, since filter_the_content() has no edit-permission capability gate. | ||||
| CVE-2026-125948 | 2 Wordpress-extensions, Wpzoom | 2 Recipe Card Blocks Lite, Recipe Card Blocks Lite | 2026-11-15 | 6.4 Medium |
| The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post() preserves block-delimiter HTML comments verbatim on save, a Contributor can embed event-handler payloads inside the block's steps[].text attribute in a draft or pending post without the unfiltered_html capability, and the payload executes for any visitor — including privileged editors and administrators who preview or publish the post — as well as through the public print endpoint. | ||||
| CVE-2026-124218 | 2 Addonsorg, Wordpress-extensions | 2 Drag And Drop File Upload For Elementor Forms, Drag And Drop File Upload For Elementor Forms | 2026-11-15 | 8.2 High |
| The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the "yeepdf_not_save" privacy option is enabled, a commonly used production setting that triggers the remove_files() cleanup path. | ||||
| CVE-2026-119077 | 2 Elextensions, Wordpress-extensions | 2 Elex Wordpress Helpdesk & Customer Ticketing System, Elex Wordpress Helpdesk & Customer Ticketing System | 2026-11-15 | 9.8 Critical |
| The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack. | ||||
| CVE-2026-126029 | 2 Wordpress-extensions, Wpzoom | 2 Wpzoom Addons For Elementor, Wpzoom Addons For Elementor | 2026-11-15 | 6.4 Medium |
| The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-75578 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root. | ||||
| CVE-2026-75577 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command. | ||||
| CVE-2026-75576 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration file through the VPN client config page with a filename containing $() shell substitution, which is passed through Lua %q to /bin/sh -c. | ||||
| CVE-2026-75495 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 8.1 High |
| Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution. | ||||
| CVE-2026-75494 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.4 High |
| Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device. | ||||
| CVE-2026-75493 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 5.9 Medium |
| Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service. | ||||
| CVE-2026-75492 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.5 High |
| Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram lacking a space in the request line, causing strncpy() to overflow a 10-byte stack buffer and crash stun_client for denial of service. | ||||
| CVE-2026-75491 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 8.1 High |
| Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root. | ||||
| CVE-2026-75490 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.5 High |
| Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycmagent._tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root. | ||||
| CVE-2026-75489 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 6.8 Medium |
| Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points. | ||||
| CVE-2026-75488 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 5.9 Medium |
| Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and crashing the CWMP process. | ||||
| CVE-2026-75487 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export. | ||||
| CVE-2026-123338 | 1 Apache | 1 Datasketches C++ | 2026-11-15 | N/A |
| Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated. This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0. Users are recommended to upgrade to version 5.3.1, which fixes the issue. | ||||