rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-6119 AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery
A vulnerability was identified in AstrBotDevs AstrBot up to 4.22.1. The affected element is the function post_data.get of the component API Endpoint. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: AstrBotDevs
product: AstrBot
cpes: cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Yu_Bao (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-12T05:00:20.093Z
CVE-2026-6120 Tenda F451 httpd DhcpListClient fromDhcpListClient stack-based overflow
A vulnerability was detected in Tenda F451 1.0.0.7. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jimi (VulDB User)
Published: 2026-04-12T06:00:20.674Z
CVE-2026-6121 Tenda F451 httpd WrlclientSet stack-based overflow
A flaw has been found in Tenda F451 1.0.0.7. Affected by this vulnerability is the function WrlclientSet of the file /goform/WrlclientSet of the component httpd. This manipulation of the argument GO causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jimi (VulDB User)
Published: 2026-04-12T07:15:13.799Z
CVE-2026-6122 Tenda F451 httpd L7Prot frmL7ProtForm stack-based overflow
A vulnerability has been found in Tenda F451 1.0.0.7. Affected by this issue is the function frmL7ProtForm of the file /goform/L7Prot of the component httpd. Such manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxm666 (VulDB User)
Published: 2026-04-12T07:30:14.700Z
CVE-2026-6123 Tenda F451 httpd addressNat fromAddressNat stack-based overflow
A vulnerability was found in Tenda F451 1.0.0.7. This affects the function fromAddressNat of the file /goform/addressNat of the component httpd. Performing a manipulation of the argument entrys results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxm666 (VulDB User)
Published: 2026-04-12T08:15:11.890Z
CVE-2026-6124 Tenda F451 httpd SafeMacFilter fromSafeMacFilter stack-based overflow
A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxm666 (VulDB User)
Published: 2026-04-12T09:00:18.190Z
CVE-2026-6125 Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection
A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-94
description: Code Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Dromara
product: warm-flow
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: anch0r (VulDB User)
Published: 2026-04-12T09:30:22.132Z
CVE-2026-6126 zhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.0.4. The affected element is an unknown function of the component Administrative HTTP Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-306
description: Missing Authentication
cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: zhayujie
product: chatgpt-on-wechat CowAgent
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Yu_Bao (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-12T10:30:12.107Z
CVE-2026-6127 Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _elementor_data meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the _elementor_data meta field with show_in_rest but omits a sanitize_callback, relying instead on a rest_pre_insert_post filter (sanitize_post_data function) that only sanitizes JSON-encoded request bodies. When a contributor sends a form-encoded PATCH request to the WordPress REST API, the json_decode() call on the raw body returns null, causing all sanitization to be skipped. The unsanitized data is then stored via update_post_meta() and later output without escaping through multiple widget sinks including the HTML widget's print_unescaped_setting() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: elemntor
product: Elementor Website Builder – more than just a page builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Jonah Burgess
Published: 2026-05-01T05:29:53.183Z
CVE-2026-6129 zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication
A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-306
description: Missing Authentication
cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: zhayujie
product: chatgpt-on-wechat CowAgent
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R
baseSeverity: HIGH
Credits: lang: en
value: York Shen (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-12T19:45:12.190Z
CVE-2026-6130 chatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection
A flaw has been found in chatboxai chatbox up to 1.20.0. This impacts the function StdioClientTransport of the file src/main/mcp/ipc-stdio-transport.ts of the component Model Context Protocol Server Management System. Executing a manipulation of the argument args/env can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: chatboxai
product: chatbox
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Yu_Bao (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-12T22:00:22.045Z
CVE-2026-6131 Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection
A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Totolink
product: A7100RU
cpes: cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: CRITICAL
Credits: lang: en
value: LtzHust2 (VulDB User)
Published: 2026-04-12T22:15:14.611Z
CVE-2026-6132 Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection
A vulnerability was determined in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setLedCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Totolink
product: A7100RU
cpes: cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: CRITICAL
Credits: lang: en
value: LtzHuster (VulDB User)
Published: 2026-04-12T22:30:20.539Z
CVE-2026-6133 Tenda F451 SafeUrlFilter fromSafeUrlFilter stack-based overflow
A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958. This affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxm666 (VulDB User)
Published: 2026-04-12T22:45:12.748Z
CVE-2026-6134 Tenda F451 qossetting fromqossetting stack-based overflow
A security flaw has been discovered in Tenda F451 1.0.0.7_cn_svn7958. This vulnerability affects the function fromqossetting of the file /goform/qossetting. Performing a manipulation of the argument qos results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxm666 (VulDB User)
Published: 2026-04-12T23:00:38.601Z
CVE-2026-6135 Tenda F451 SetIpBind fromSetIpBind stack-based overflow
A weakness has been identified in Tenda F451 1.0.0.7_cn_svn7958. This issue affects the function fromSetIpBind of the file /goform/SetIpBind. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxm666 (VulDB User)
Published: 2026-04-12T23:15:12.163Z
CVE-2026-6136 Tenda F451 L7Im frmL7ImForm stack-based overflow
A security vulnerability has been detected in Tenda F451 1.0.0.7_cn_svn7958. Impacted is the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxm666 (VulDB User)
Published: 2026-04-12T23:30:20.978Z
CVE-2026-6137 Tenda F451 AdvSetWan fromAdvSetWan stack-based overflow
A vulnerability was detected in Tenda F451 1.0.0.7_cn_svn7958. The affected element is the function fromAdvSetWan of the file /goform/AdvSetWan. The manipulation of the argument wanmode/PPPOEPassword results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: F451
cpes: cpe:2.3:o:tenda:f451_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxm666 (VulDB User)
Published: 2026-04-12T23:45:13.469Z
CVE-2026-6138 Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection
A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mac causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Totolink
product: A7100RU
cpes: cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: CRITICAL
Credits: lang: en
value: LtzHuster (VulDB User)
Published: 2026-04-13T00:00:22.129Z
CVE-2026-6139 Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection
A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Totolink
product: A7100RU
cpes: cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: CRITICAL
Credits: lang: en
value: LtzHuster (VulDB User)
Published: 2026-04-13T00:15:12.109Z
CVE-2026-6140 Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection
A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument FileName results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Totolink
product: A7100RU
cpes: cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: CRITICAL
Credits: lang: en
value: LtzHuster (VulDB User)
Published: 2026-04-13T00:30:13.660Z
CVE-2026-6141 danielmiessler Personal_AI_Infrastructure parse_url.ts os command injection
A vulnerability was determined in danielmiessler Personal_AI_Infrastructure up to 2.3.0. Affected is an unknown function of the file Skills/Parser/Tools/parse_url.ts. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 14322e87e58bf585cf3c7b9295578a6eb7dc4945. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: danielmiessler
product: Personal_AI_Infrastructure
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: davidgilmore (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-13T00:45:12.748Z
CVE-2026-6142 tushar-2223 Hotel Management System roomdelete.php sql injection
A vulnerability was identified in tushar-2223 Hotel Management System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. Affected by this vulnerability is an unknown functionality of the file /admin/roomdelete.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: tushar-2223
product: Hotel Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: wacool (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-13T01:00:21.186Z
CVE-2026-6143 farion1231 cc-switch ProxyServer server.rs cross-domain policy
A security flaw has been discovered in farion1231 cc-switch up to 3.12.3. Affected by this issue is some unknown functionality of the file src-tauri/src/proxy/server.rs of the component ProxyServer. The manipulation results in permissive cross-domain policy with untrusted domains. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-942
description: Permissive Cross-domain Policy with Untrusted Domains
cwe_id: CWE-346
description: Origin Validation Error
Affected products: vendor: farion1231
product: cc-switch
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: r00tuser (VulDB User)
Published: 2026-04-13T01:15:13.708Z
CVE-2026-6145 User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the is_admin_creation_process() method relying solely on the presence of action=createuser in the $_REQUEST superglobal without performing any authentication or capability check. This makes it possible for unauthenticated attackers to bypass the admin approval requirement when registering new accounts via the fallback submission path.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: wpeverest
product: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Anthony Cihan
Published: 2026-05-14T08:24:27.293Z
CVE-2026-6146 Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys
Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.

Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.

Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.
Problem types: cwe_id: CWE-338
description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected products: vendor: BIGFOOT
product: Amazon::Credentials
default_status: unaffected
Published: 2026-05-11T19:12:17.630Z