CVE Vulnerability Catalog

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine. The filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.

The NoviGest Desktop App contains an XML External Entity (XXE) injection vulnerability in the SAFT import feature. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker could provide a manipulated XML file to read local files accessible to the application process.

The NoviGest Desktop App's Java RMI service lacks authentication in critical functions. An attacker with network access can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained to execute operating system commands on the server.

Dell PowerProtect Data Domain contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A high privileged attacker with remote access could exploit it to execute commands.

Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low privileged attacker with remote access could exploit it to perform unauthorized operations.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow. When both features are enabled, unauthenticated users can register and log in without being approved by an administrator.

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails. When a recipient field is configured to echo a submitted value, unauthenticated attackers can replace the recipient list and relay attacker-composed email from the site's own domain.

Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems.

Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems.

Dell PowerProtect Data Domain contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could exploit it to achieve command execution.

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. A low privileged attacker with remote access could exploit it to bypass protection mechanisms.

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications. Verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount. This allows an unauthenticated attacker holding a single genuine low-value transaction to mark arbitrary higher-value orders as paid.

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. A client configured to only allow the `code` response type could receive back a valid token of another type, such as `id_token`. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.

Some API endpoints allowed creating order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

A local privilege escalation exists due to improper authentication. The vulnerability affects Acronis Cyber Protect Cloud Agent (Windows) before build 42569 and Acronis Cyber Protect 17 (Windows) before build 42587.

Dell PowerProtect Data Domain contains an Allocation of Resources Without Limits or Throttling vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to denial of service.

Dell PowerProtect Data Domain contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to command execution.

Dell PowerProtect Data Domain contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to elevation of privileges.