Vuldb Updates

A vulnerability classified as problematic was found in Emergency Password Reset Plugin up to 8.0 on WordPress. Impacted is an unknown function of the file index.php of the component Setting Handler. The manipulation results in cross-site request forgery. This vulnerability was named CVE-2024-35648. The attack may be performed from remote. There is no available exploit.

A vulnerability has been found in Jegstudio Multiple Theme Plugin up to 1.0.3 on WordPress and classified as critical. Affected by this vulnerability is the function notice_closed. The manipulation leads to missing authorization. This vulnerability is referenced as CVE-2024-33685. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability labeled as critical has been found in Integrate Google Drive Plugin up to 1.3.8 on WordPress. The impacted element is an unknown function. The manipulation results in missing authorization. This vulnerability is reported as CVE-2024-32949. The attack can be launched remotely. No exploit exists.

A vulnerability was found in Extend Themes on WordPress. It has been declared as problematic. Impacted is an unknown function. The manipulation results in cross-site request forgery. This vulnerability is known as CVE-2024-34810. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as problematic has been detected in Dimitri Grassi Salon Booking System Plugin up to 10.10.7 on WordPress. The affected element is an unknown function. Performing a manipulation results in missing authorization. This vulnerability is known as CVE-2025-32220. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability labeled as critical has been found in The Control Group Voyager up to 1.3.0. Affected by this vulnerability is an unknown functionality of the file /admin/voyager-assets of the component Configuration File Handler. The manipulation of the argument path results in path traversal. This vulnerability is reported as CVE-2020-37214. The attack can be launched remotely. Moreover, an exploit is present. The affected component should be upgraded.

A vulnerability marked as problematic has been reported in Avirtum iPages Flipbook Plugin up to 1.5.1 on WordPress. This impacts an unknown function. The manipulation leads to missing authorization. This vulnerability is listed as CVE-2024-33909. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic has been found in MarketingFire Widget Options Plugin up to 4.0.1 on WordPress. Affected by this vulnerability is an unknown functionality. This manipulation causes insertion of sensitive information into sent data. This vulnerability is registered as CVE-2024-35690. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as problematic was found in ali2woo AliNext Plugin up to 3.3.5 on WordPress. Affected by this issue is some unknown functionality. Such manipulation leads to missing authorization. This vulnerability is documented as CVE-2024-37210. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in Mesalvo Meona Client Launcher Component and Meona Server Component and classified as critical. Affected is an unknown function. Executing a manipulation can lead to code injection. This vulnerability appears as CVE-2026-22314. The attack may be performed from remote. There is no available exploit.

A vulnerability categorized as problematic has been discovered in Vmware Spring AMQP up to 2.4.17/3.1.15/3.2.10/4.0.3. The impacted element is the function RabbitTemplate.sendAndReceive. The manipulation results in insufficiently random values. This vulnerability is cataloged as CVE-2026-41701. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability classified as critical was found in YAML up to 1.27_000. The affected element is the function Load of the component glob. Executing a manipulation can lead to code injection. This vulnerability appears as CVE-2019-25777. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

A vulnerability, which was classified as critical, has been found in YAML up to 1.29. The impacted element is the function DESTROY. The manipulation leads to code injection. This vulnerability is traded as CVE-2017-20285. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in SourceCodester Online Reviewer Management System 1.0 and classified as critical. The affected element is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. This vulnerability is tracked as CVE-2026-105247. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability, which was classified as critical, was found in Net::Whois::Raw up to 2.99043. This affects an unknown function. The manipulation results in improper input validation. This vulnerability is known as CVE-2026-19954. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Dimitri Grassi Salon Booking System Plugin up to 10.31.5 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to improper access controls. This vulnerability is referenced as CVE-2026-81793. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in WPdevelop Booking Calendar Plugin up to 11.8.4 on WordPress. It has been rated as problematic. The affected element is an unknown function. Performing a manipulation results in race condition. This vulnerability was named CVE-2026-39601. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in vgmstream up to r2117. It has been declared as critical. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. This vulnerability is cataloged as CVE-2026-105248. The attack may be launched remotely. There is no exploit available. It is best practice to apply a patch to resolve this issue.

A vulnerability was found in vgmstream up to r2117. It has been rated as problematic. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. This vulnerability is registered as CVE-2026-105249. The attack needs to be launched locally. No exploit is available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Papermerge 3.5.3. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/documents/upload of the component Document Upload. Performing a manipulation results in path traversal. This vulnerability was named CVE-2026-105314. The attack may be initiated remotely. There is no available exploit.