CVE Vulnerability Catalog

The WP Discussion Board plugin has a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 2.6.0.

Topluyo Desktop for Linux prior to version 2026.9.2410 unsafely processes user-controlled URLs, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.13.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS. This issue affects GetPaid: from n/a through 2.8.62.

The Crowd Favorite DXP ToolKit plugin contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects DXP ToolKit versions from n/a through 2.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS. This issue affects DXP ToolKit: from n/a through 2.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS. This issue affects eCommerce Product Catalog: from n/a through 3.6.4.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.24.

Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data. This issue affects Contact Form by Supsystic: from n/a through 1.10.5.

The BuddyPress plugin for WordPress contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions up to and including 14.5.2.

The Aman FunnelKit Automations (wp-marketing-automations) plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects FunnelKit Automations versions from n/a through 3.8.5.2.

Dell iDRAC Service Module (iSM) for Windows, Linux, and ESXi versions prior to 6.1.1.0 contains an improper control of code generation (code injection) vulnerability. A high-privileged attacker with local access could exploit this to elevate privileges.

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding on the output filename after URL parsing, allowing an attacker to embed %2e%2e%2f sequences that survive parsing but decode into directory traversal sequences, enabling writes to arbitrary filesystem paths.

The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. An authenticated attacker can execute arbitrary commands with www-data privileges. Fixed in version 2026061802.

The WordPress plugin My auctions allegro (my-auctions-allegro-free-edition) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.3.

The che-machine-exec service constructs a shell command by concatenating user-controlled input (username and namespace fields from /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c invocation without escaping. When authentication is disabled (default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec can access via shell command substitution.

The Joomla extension iCagenda (icagenda.com) contains a CSV formula injection vulnerability in the registrations export. This affects versions 3.5.0 to 4.0.16.

The Joomla extension iCagenda (icagenda.com) contains a stored XSS vulnerability via a URL-type custom field in events. This affects versions 3.2.1 to 4.0.16.

In the Linux kernel, the Hyper-V (hv) driver incorrectly forces the VMBus connection state to DISCONNECTED before calling vmbus_disconnect(). As a result, vmbus_initiate_unload() does not unload the connection because it only acts when the state is CONNECTED, so the Hyper-V host may continue sending messages or posting VMBus interrupts.

In the Linux kernel power supply subsystem, a use-after-free vulnerability exists. If a power supply is unregistered while its external_power_changed() callback is still running, the driver may free data that the callback is still accessing, leading to a kernel crash (NULL pointer dereference).