Vuldb Updates

A vulnerability marked as problematic has been reported in CordysCRM up to 1.9.3. Affected by this issue is some unknown functionality. The manipulation of the argument owner leads to improper authorization. This vulnerability is listed as CVE-2026-108704. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as critical has been identified in 1Panel-dev CordysCRM up to 1.9.3. Affected is an unknown function of the file poc_approval_resource_push.py. Executing a manipulation of the argument resourceId can lead to improper authorization. This vulnerability is registered as CVE-2026-108703. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in WuKongOpenSource Wukong_HRM. It has been classified as critical. The affected element is the function ParamAspect. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-108707. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability described as problematic has been identified in 1Panel-dev CordysCRM up to 1.9.3. This affects an unknown part of the file poc_custom_form_data_import.py of the component Import Endpoint. The manipulation of the argument customFormId results in improper authorization. This vulnerability is cataloged as CVE-2026-108705. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in elunez eladmin and classified as problematic. Impacted is the function downloadS3Storage of the file /api/s3Storage/download of the component downloadS3Storage handler. Executing a manipulation of the argument ID can lead to improper authorization. This vulnerability is handled as CVE-2026-108706. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

A vulnerability was found in WuKongOpenSource Wukong_HRM. It has been declared as critical. The impacted element is the function EmployeeAspect of the file poc_salary_archives_history.py. The manipulation results in improper authorization. This vulnerability was named CVE-2026-108708. The attack may be performed from remote. There is no available exploit. It is best practice to apply a patch to resolve this issue.

A vulnerability categorized as problematic has been discovered in C4illin ConvertX up to 0.19.0. This impacts an unknown function of the file src/converters/pandoc.ts of the component Pandoc Converter. Such manipulation leads to path traversal. This vulnerability is referenced as CVE-2026-108694. It is possible to launch the attack remotely. No exploit is available.

A vulnerability labeled as problematic has been found in MultiVendorX Plugin up to 5.0.19 on WordPress. This affects an unknown function of the file /wp-json/multivendorx/v1/settings of the component Settings REST Endpoint. Such manipulation leads to improper authorization. This vulnerability is listed as CVE-2026-108695. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as critical, was found in CoreUnion CoreShop up to 1.5.5. This vulnerability affects the function OrderController of the component Order Controller. Such manipulation of the argument id/reshipId leads to authorization bypass. This vulnerability is traded as CVE-2026-108696. The attack may be launched remotely. There is no exploit available.

A vulnerability categorized as problematic has been discovered in Denshi Nyusatsu Core System up to 6 R4. This affects an unknown function. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2022-46287. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in CX-Drive up to 3.00. It has been classified as critical. Affected by this issue is some unknown functionality of the component File Handler. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2022-46282. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in libXpm. Affected is an unknown function of the component Comment Parseer. The manipulation results in infinite loop. This vulnerability is reported as CVE-2022-46285. The attack can be launched remotely. No exploit exists. A patch should be applied to remediate this issue.

A vulnerability was found in Siemens Polarion ALM. It has been rated as critical. The affected element is an unknown function of the component Header Handler. This manipulation of the argument Host causes injection. This vulnerability is handled as CVE-2022-46265. The attack can be initiated remotely. There is not any exploit available.

A vulnerability, which was classified as problematic, was found in GitHub Enterprise Server up to 3.3.16/3.4.11/3.5.8/3.6.4. This affects an unknown part of the component API. Executing a manipulation can lead to information disclosure. This vulnerability is tracked as CVE-2022-46257. The attack is only possible within the local network. No exploit exists. You should upgrade the affected component.

A vulnerability identified as critical has been detected in GitHub Enterprise Server 3.7.0. Affected is an unknown function. The manipulation leads to path traversal. This vulnerability is traded as CVE-2022-46255. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability marked as critical has been reported in Oracle Retail Financial Integration 15.0/16.0. This affects an unknown part of the component PeopleSoft Integration. The manipulation leads to download of code without integrity check. This vulnerability is referenced as CVE-2020-5398. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability classified as critical has been found in Oracle Retail Integration Bus 15.0.3/16.0.3. This issue affects some unknown processing of the component RIB Kernal. This manipulation causes download of code without integrity check. This vulnerability is tracked as CVE-2020-5398. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Oracle Retail Predictive Application Server 14.0.3/14.1.3/15.0.3/16.0.3. The affected element is an unknown function of the component RPAS Server. Performing a manipulation results in download of code without integrity check. This vulnerability is cataloged as CVE-2020-5398. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Oracle Retail Service Backbone 15.0/16.0. The impacted element is an unknown function of the component RSB Installation. Executing a manipulation can lead to download of code without integrity check. This vulnerability is registered as CVE-2020-5398. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

A vulnerability identified as critical has been detected in Oracle Rapid Planning 12.1/12.2. This impacts an unknown function of the component Installation. Performing a manipulation results in download of code without integrity check. This vulnerability is known as CVE-2020-5398. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.