CVE Vulnerability Catalog

In Quick.CMS, the admin UI restricts deletion of the primary language, but the API endpoint lacks server-side authorization. An authenticated admin can send a direct HTTP request to delete the primary language, causing Denial of Service (DoS). Combined with a CSRF vulnerability (CVE-2026-1468), an unauthenticated attacker can trick an admin into clicking a malicious link, triggering DoS.

A vulnerability in the cowlib library allows an unauthenticated remote attacker to exhaust memory on a vulnerable server or client by sending specially crafted HTTP/2 or HTTP/3 frames. The issue stems from missing limits in the HPACK and QPACK decoder, which processes arbitrarily long prefixed integers, causing large bignum allocations and heavy garbage collection churn.

The Web Directory Free plugin for WordPress up to version 1.7.13 is vulnerable to generic SQL Injection via the 'levels' parameter. Insufficient input sanitization and lack of prepared statements allow unauthenticated attackers to append additional SQL queries, potentially leading to extraction of sensitive database information.

The Eazy Plugin Manager plugin for WordPress up to version 4.4.1 is vulnerable to privilege escalation. The AJAX handler `wp_ajax_pos_get_option` lacks capability checks, and the REST endpoint `admin/login` is publicly accessible, authenticating based on a hash of values stored in options. An authenticated attacker with Subscriber-level access can read the `eazywp_connecting_info` and `eazywp_connection` options, compute the auth key, and obtain administrator cookies, taking over the site. This requires the remote connection feature to be configured.

The PickPlugins Question Answer plugin for WordPress up to version 1.2.73 is vulnerable to SQL Injection via the 'id' GET parameter in the user profile template. The qa_user_profile_card() function uses wp_unslash(), which removes magic quotes protection, and then directly concatenates input into a SQL query without proper sanitization. This allows unauthenticated attackers to append additional SQL queries and extract sensitive database information.

ELECOM wireless LAN routers and access points contain an OS Command Injection vulnerability in the Restore Settings function. An attacker who can log in to the device can exploit this to execute arbitrary OS commands.

ELECOM wireless LAN routers and access points contain an OS Command Injection vulnerability in the WebUI. An attacker who can log in to the device can exploit this to execute arbitrary OS commands.

The Bookly plugin for WordPress (up to version 27.5) is vulnerable to time-based SQL injection via the 'staff_ids' parameter. An unauthenticated attacker can append additional SQL queries to existing ones, allowing extraction of sensitive database information. A two-request chain is required, and lack of CSRF/nonce validation enables cross-site attacks.

Due to incorrect behavior order, a low-privileged remote attacker can trigger an inconsistent account state via crafted input and overwrite existing user passwords, potentially resulting in complete administrative unavailability of the device.

A low-privileged remote attacker can gain administrator privileges due to missing authorization in the configuration table insert path, resulting in full system access.

A low-privileged remote attacker can perform privileged configuration changes reserved for the administrator, including permission management, due to incorrect authorization.

The TrueBooker plugin for WordPress (up to version 1.2.2) is vulnerable to generic SQL injection via the 'alldata[truebooker_user]' parameter. An unauthenticated attacker can append additional SQL queries to extract sensitive database information. The nonce is exposed to unauthenticated users, and exploitation requires specific booking fields to be present.

The Premium Packages plugin for WordPress (up to version 6.2.0) is vulnerable to SQL injection via the 'code' parameter in the REST API endpoint /wp-json/wpdmpp/v1/cart/coupon. An unauthenticated attacker can append additional SQL queries to extract sensitive database information due to lack of proper query preparation.

The WP Fast Total Search plugin for WordPress (up to version 1.80.280) is vulnerable to generic SQL injection via the 'form_data[s]' parameter. An unauthenticated attacker can append additional SQL queries to extract sensitive database information.

The Better Messages plugin for WordPress up to version 2.15.19 has an arbitrary file deletion vulnerability in the delete_sticker function. An authenticated attacker with administrator privileges can delete any file on the server, potentially leading to remote code execution.

The Tablesome Table WordPress plugin before version 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions. This allows unauthenticated users to create new published posts and overwrite arbitrary existing posts and pages.

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.3 does not properly sanitize and escape a parameter before reflecting it back in an admin page. This leads to a Reflected Cross-Site Scripting (XSS) that could be used against high-privilege users such as admins.

The Demi plugin for WordPress up to version 0.0.7 stores the HMAC key and restore token in a publicly accessible subdirectory of uploads. An unauthenticated attacker can retrieve the key and forge a request to the demi_restore_step AJAX handler, allowing recursive deletion of arbitrary directories.

The zip-lib library before version 1.1.0 is vulnerable to Directory Traversal via the caching mechanism for path validation during extraction. An attacker can bypass security checks because the isOutsideTargetFolder function only validates the path when the initial symlink is created.

A Broken Access Control vulnerability in the Xendit Payment plugin for WordPress versions up to 7.1.0. An unauthenticated attacker can gain unauthorized access.