Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.

A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /order-details.php of the component Parameter Handler. The manipulation of the argument orderid results in sql injection. It is possible to launch the attack remotely.

Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.

Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.

Subscriber SQL Injection in Tourfic <= 2.22.5 versions.

Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.

Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.

A weakness has been identified in Tenda CH22 1.0.0.1. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.