VulDB Recent Entries

A vulnerability was found in QILING Disk Master 6.0.0.0 and classified as critical. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver. Such manipulation leads to improper access controls. This vulnerability is referenced as CVE-2026-15476. The attack can only be performed from a local environment. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

A vulnerability has been found in MiniTool Partition Wizard up to 13.6 and classified as critical. The affected element is an unknown function in the library pwdrvio.sys of the component Signed Kernel Driver. This manipulation causes improper access controls. The identification of this vulnerability is CVE-2026-15475. The attack can only be executed locally. Furthermore, there is an exploit available. The affected component should be upgraded. The vendor was contacted early about this disclosure.

A vulnerability, which was classified as problematic, was found in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Call Recording Handler. The manipulation of the argument callId results in improper authorization. This vulnerability was named CVE-2026-15474. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-15473. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as problematic was found in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Executing a manipulation can lead to improper authorization. This vulnerability is handled as CVE-2026-15472. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as problematic has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulation results in improper authorization. This vulnerability is known as CVE-2026-15471. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability described as problematic has been identified in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-15470. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability marked as critical has been reported in Genolve Plugin up to 5.0.5 on WordPress. Affected by this vulnerability is the function genolve_setOpt of the component Capability Check. This manipulation causes improper authorization. This vulnerability appears as CVE-2026-1359. The attack may be initiated remotely. There is no available exploit.

A vulnerability labeled as problematic has been found in robin-w bbp Style Pack Plugin up to 6.4.5 on WordPress. Affected is the function bsp_topic_fields_form_save/bsp_topic_content_append_topic_fields of the component Topic Form Additional Fields Feature. The manipulation of the argument bsp_topic_fields_label{n} results in cross site scripting. This vulnerability is reported as CVE-2026-15010. The attack can be launched remotely. No exploit exists.

A vulnerability identified as problematic has been detected in corvusinfo CorvusPay WooCommerce Payment Gateway Plugin up to 2.7.4 on WordPress. This impacts an unknown function of the file /wp-json/corvuspay/success of the component approval_code Handler. The manipulation of the argument approval_code leads to cross site scripting. This vulnerability is documented as CVE-2026-6939. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as problematic has been discovered in freshlabs fresh Podcaster Plugin up to 1.0.7 on WordPress. This affects the function freshpodcaster of the component Shortcode Handler. Executing a manipulation of the argument attributes can lead to cross site scripting. This vulnerability is registered as CVE-2026-1382. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in blendmedia WP CTA Plugin up to 2.2.2 on WordPress. It has been rated as critical. The impacted element is the function ajaxCheck. Performing a manipulation of the argument fildname results in sql injection. This vulnerability is cataloged as CVE-2026-4661. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in webaways NEX-Forms Plugin up to 9.2.2 on WordPress. It has been declared as critical. The affected element is an unknown function of the component Authorization. Such manipulation of the argument saved_user_email_address leads to authorization bypass. This vulnerability is listed as CVE-2026-9017. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in wpdevteam Essential Addons for Elementor Plugin up to 6.6.10 on WordPress. It has been classified as critical. Impacted is an unknown function of the component Login/Register Widget. This manipulation causes crlf injection. This vulnerability is tracked as CVE-2026-15155. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in wclovers WCFM Plugin up to 6.7.27 on WordPress and classified as critical. This issue affects the function is_user_logged_in/current_user_can of the file wcfm-my-account-enquiry-manage.php of the component Enquiry Management. The manipulation of the argument reply_content results in authorization bypass. This vulnerability is identified as CVE-2026-12994. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in boldgrid W3 Total Cache Plugin up to 2.9.4 on WordPress and classified as problematic. This vulnerability affects the function setupSources of the component Minify. The manipulation of the argument f_array[] leads to path traversal. This vulnerability is referenced as CVE-2026-9282. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, was found in postmagthemes Context Blog Plugin up to 1.3.5 on WordPress. This affects an unknown part of the component Context Blog Modal Popup. Executing a manipulation can lead to information disclosure. The identification of this vulnerability is CVE-2026-6801. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in videousermanuals White Label CMS Plugin up to 2.7.12 on WordPress. Affected by this issue is some unknown functionality of the component Admin Settings. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-11898. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in wclovers WCFM Marketplace Plugin up to 3.7.3 on WordPress. Affected by this vulnerability is the function innerHTML of the file /wp-json/wp/v2/media of the component Media. Such manipulation of the argument post_title leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-12126. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic has been found in subratamal Wallet for WooCommerce Plugin up to 1.6.4 on WordPress. Affected is an unknown function of the component AJAX Handler. This manipulation of the argument Search causes authorization bypass. This vulnerability is handled as CVE-2026-12103. The attack can be initiated remotely. There is not any exploit available.