CVE Vulnerability Catalog

A cross-site scripting vulnerability was found in Mage AI up to version 0.9.79 in the Sign-in Flow component, file mage_ai/frontend/components/Sessions/SignForm/index.tsx. Manipulation of the query.redirect_url argument allows remote XSS attacks.

In Jinher OA C6, an SQL injection vulnerability was found in the file /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx. Manipulating the queryID argument allows remote attack. The exploit is public, and the vendor did not respond.

In iAI Lab PDF AI App version 4.21.0 on Android, a vulnerability exists where manipulating the _display_name argument in the getExternalCacheDir function of the chatpdf.pro component leads to path traversal. The attack requires local access. The exploit has been released publicly and may be used for attacks. The vendor did not respond.

In vertex-app up to version 2026.02.12, a vulnerability was found in the Log Viewer Endpoint component allowing OS command injection via the req.query argument in app/model/LogMod.js. The attack is remotely exploitable and the exploit is public.

A vulnerability in GL.iNet MT3000 up to version 4.4.5. Unknown code in ovpnclient.sh of the OpenVPN Client Import Workflow component allows command injection. Remote attack, exploit public. Fixed in version 4.9.0_beta3-1012-0513-1778656146.

The Photo Gallery by 10Web plugin for WordPress up to version 1.8.41 is vulnerable to time-based SQL Injection via the 'compact_album_order_by' shortcode parameter. Authenticated attackers with contributor-level access can inject additional SQL queries and trigger them unauthenticated via another AJAX handler.

The WP Maps plugin for WordPress up to version 4.9.4 contains a Stored XSS vulnerability via the 'location_messages' parameter. Attackers with administrator privileges (or lower if granted) can inject scripts that execute when users access the page.

The Debug Log Manager plugin for WordPress up to version 2.5.0 allows unauthenticated attackers to inject forged entries into the WordPress debug log. The vulnerability is exploitable when JavaScript error logging is enabled and the nonce is publicly disclosed.

The MapPress Maps plugin for WordPress up to version 2.96.6 has an authorization bypass in the REST API. Missing ownership verification allows unauthenticated attackers to read map data (titles, addresses, coordinates, body content) and authenticated attackers (Contributor and above) to modify, delete, or clone any map.

The Klamra Paycal for Aspaclaria WordPress plugin up to version 1.1.4 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'invoice_id' parameter. Authenticated attackers with subscriber-level access can download arbitrary customer invoices by enumerating sequential post IDs.

The SEO Plugin by Squirrly SEO for WordPress up to version 12.4.16 contains an authorization bypass vulnerability. Authenticated attackers with contributor-level access or higher can invoke privileged Squirrly cloud API operations, such as revoking Google Search Console and Google Analytics integrations, which are normally restricted to administrators with the sq_manage_settings capability.

The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin up to version 2.8.15 is vulnerable to Reflected Cross-Site Scripting via URL parameters in iframe mode. Unauthenticated attackers can inject arbitrary scripts if they trick a user into clicking a link, and iframe mode is enabled on at least one ad block.

The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This allows authenticated attackers with administrator-level access or above to read the contents of arbitrary files on the server, which may contain sensitive information.

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress up to version 1.3.9.7 is vulnerable to Stored Cross-Site Scripting via the 'drag_n_drop_text' and 'drag_n_drop_browse_text' settings due to insufficient input sanitization and output escaping.

The OptinCraft plugin for WordPress up to version 1.2.0 is vulnerable to generic SQL injection via the 'order_by' parameter. The vulnerability requires administrator-level authentication and allows appending additional SQL queries to extract sensitive data.

The LearnPress plugin for WordPress up to version 4.3.6 exposes sensitive data via the 'return_type' parameter. An unauthenticated attacker can extract passwords for protected courses and content, author, and name of unpublished posts.

The EmbedPress plugin for WordPress up to version 4.5.3 is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute whenever a user visits the page.

The Click to Chat – WA Widget plugin for WordPress up to version 4.38 is vulnerable to Stored Cross-Site Scripting (XSS) via the [chat] shortcode 'num' parameter. Insufficient escaping causes HTML entities to be decoded in event attributes, allowing arbitrary JavaScript execution. Attack requires Contributor-level access or higher.

The WPForms plugin for WordPress up to version 1.10.0.1 does not properly verify the authenticity of PayPal Commerce webhooks. Unauthenticated attackers can forge webhook events and modify payment records, e.g., reactivate a cancelled subscription.

The Essential Addons for Elementor plugin for WordPress up to version 6.6.4 has an information exposure vulnerability via the ajax_load_more function. Unauthenticated attackers can extract data from password-protected, private, or draft posts.