---METADATA---
VENDOR: Edgar Rojas
PRODUCT: WooCommerce PDF Invoice Builder
AFFECTED_VERSIONS: n/a through 2.0.8
---END_METADATA---

Description Summary:
A code injection vulnerability in the WooCommerce PDF Invoice Builder plugin allows unauthenticated remote attackers to perform remote code inclusion.

Executive Summary:
A critical remote code inclusion vulnerability in the WooCommerce PDF Invoice Builder plugin permits unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-52704

Affected Software: Edgar Rojas WooCommerce PDF Invoice Builder

Affected Versions: n/a through 2.0.8

Vulnerability: This is an Improper Control of Generation of Code vulnerability that facilitates Remote Code Inclusion. The flaw is exploitable by unauthenticated remote attackers, requiring no prior system access or credentials to trigger.

Business Impact

This vulnerability carries a maximum CVSS score of 10.0, representing the highest level of severity. Exploitation allows for complete server takeover, resulting in potential data theft, installation of malicious backdoors, and total loss of confidentiality, integrity, and availability for the affected web store.

Remediation Plan

Immediate Action: Update the WooCommerce PDF Invoice Builder plugin to a version greater than 2.0.8 immediately.

Proactive Monitoring: Audit web server access logs for suspicious requests containing unexpected file paths or code execution payloads directed at the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common code injection and remote file inclusion patterns.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 15, 2026, exploitation is confirmed to be easy, remote, and does not require authentication. Immediate remediation is mandatory as the risk of active exploitation is extremely high.

Analyst Recommendation

The availability of public exploit code combined with the unauthenticated nature of this vulnerability necessitates an emergency patching cycle. All instances of the affected plugin must be updated immediately to prevent compromise.

---METADATA---
VENDOR: WordPress
PRODUCT: FastDup
AFFECTED_VERSIONS: <= 2.7.2
---END_METADATA---

Description Summary:
An unauthenticated path traversal vulnerability exists in the FastDup plugin for WordPress, allowing attackers to access sensitive files.

Executive Summary:
A critical path traversal vulnerability in the FastDup WordPress plugin allows unauthenticated attackers to read sensitive files from the underlying server filesystem.

Vulnerability Details

CVE-ID: CVE-2026-52703

Affected Software: WordPress FastDup

Affected Versions: <= 2.7.2

Vulnerability: The plugin fails to properly sanitize user-supplied input, enabling path traversal attacks. An unauthenticated attacker can manipulate input parameters to traverse outside the intended directory and access sensitive system or configuration files.

Business Impact

The 9.6 CVSS score signifies a Critical risk to the organization. Successful exploitation allows for the disclosure of configuration files, database credentials, or sensitive site data, which can serve as a precursor to further system exploitation or data theft.

Remediation Plan

Immediate Action: Update the FastDup plugin to the latest version to address the path traversal vulnerability.

Proactive Monitoring: Monitor server logs for directory traversal patterns (e.g., ../../) targeting the WordPress installation.

Compensating Controls: Configure the web server to restrict directory listing and ensure the web user has the least privilege necessary to access the filesystem.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Path traversal vulnerabilities often lead to significant information disclosure. It is imperative to update the plugin immediately and audit sensitive configuration files (such as wp-config.php) to ensure they have not been accessed or modified by unauthorized parties.

---METADATA---
VENDOR: Subscriber
PRODUCT: WCMultiShipping
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the WCMultiShipping plugin, enabling authenticated subscribers to manipulate database queries.

Executive Summary:
An SQL injection flaw in the WCMultiShipping plugin permits authenticated subscribers to execute unauthorized database operations, threatening data integrity.

Vulnerability Details

CVE-ID: CVE-2026-52700

Affected Software: Subscriber WCMultiShipping

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a SQL injection triggered by improper input validation within the plugin. An attacker with subscriber-level authentication can leverage this to execute arbitrary SQL commands against the database.

Business Impact

This vulnerability carries a CVSS score of 8.5, indicating a high risk of unauthorized data access and potential database manipulation. Business operations relying on this plugin face significant exposure, including the potential for data exfiltration and unauthorized modification of shipping records.

Remediation Plan

Immediate Action: Update the WCMultiShipping plugin to the latest version provided by the vendor to resolve the injection point.

Proactive Monitoring: Review database access logs for anomalous, high-volume, or malformed queries that deviate from standard plugin behavior.

Compensating Controls: Deploy WAF rules designed to filter SQL syntax from incoming web requests to intercept exploitation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this as a high-priority issue. Ensure all installations of WCMultiShipping are audited for version compliance and apply vendor-supplied patches immediately upon release to mitigate the risk of database compromise.

---METADATA---
VENDOR: CIENA
PRODUCT: Navigator NCS, MCP, and Blue Planet
AFFECTED_VERSIONS: CIENA Navigator NCS 8.1; CIENA MCP <= 8.0; CIENA Planner Plus OnPrem <= 4.1; Blue Planet Inventory <=24.04.001, <=23.12.401, <=23.08.302, <=23.04.701; Blue Planet Orchestration <=24.04.2, <=23.12.3, <=23.08.4, <=23.04.2; Blue Planet Route Optimization & Analysis <=24.04.1.2-R, <=23.12.1.6-R, <=23.08.1.6-R, <=23.04.P01-9-R
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in Ciena Navigator NCS and Blue Planet products allows unauthenticated attackers to manipulate HTTP requests to gain unauthorized access.

Executive Summary:
A critical authentication bypass vulnerability in Ciena Navigator Network Control Suite and Blue Planet software allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5270

Affected Software: CIENA Navigator NCS, MCP, and Blue Planet

Affected Versions: CIENA Navigator NCS 8.1; CIENA MCP <= 8.0; CIENA Planner Plus OnPrem <= 4.1; Blue Planet Inventory <=24.04.001, <=23.12.401, <=23.08.302, <=23.04.701; Blue Planet Orchestration <=24.04.2, <=23.12.3, <=23.08.4, <=23.04.2; Blue Planet Route Optimization & Analysis <=24.04.1.2-R, <=23.12.1.6-R, <=23.08.1.6-R, <=23.04.P01-9-R

Vulnerability: This vulnerability (CWE-287) stems from improper handling of HTTP request paths and headers, enabling an unauthenticated attacker to bypass authentication mechanisms. The flaw is remotely exploitable without user interaction and is considered automatable.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to organizational infrastructure. Successful exploitation allows an attacker to bypass authentication, potentially leading to total system compromise, unauthorized data access, and disruption of critical network control operations. The high technical impact and the automatable nature of the flaw necessitate immediate remediation to prevent potential service outages or data exfiltration.

Remediation Plan

Immediate Action: Upgrade all affected Ciena product instances to the latest remediated releases as specified in the official Ciena security advisory (e.g., Blue Planet Inventory >= 24.08). Refer to the MyCiena portal for specific version compatibility and deployment instructions.

Proactive Monitoring: Monitor network access logs for anomalous HTTP request patterns, specifically those containing unusual header modifications or path traversal attempts targeting management interfaces.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect and filter malicious HTTP headers and malformed request paths directed at the Navigator NCS and Blue Planet control planes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently observed in the wild, the vulnerability is highly automatable, which increases the risk of future exploitation attempts.

Analyst Recommendation

Given the critical CVSS severity of 9.8 and the fundamental nature of the authentication bypass, administrators must prioritize patching these systems immediately. Ensure that all affected Ciena software components are updated to the recommended versions to eliminate the risk of unauthorized remote access.

---METADATA---
VENDOR: Subscriber
PRODUCT: Taskbuilder
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in Subscriber Taskbuilder allows authenticated attackers with subscriber-level access to execute arbitrary database queries.

Executive Summary:
The Taskbuilder application is vulnerable to SQL injection, which could allow a subscriber-level user to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-52697

Affected Software: Subscriber Taskbuilder

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a SQL injection vulnerability residing within the Taskbuilder application. It requires the attacker to possess a subscriber-level account to inject malicious SQL commands into the backend database.

Business Impact

The ability to perform SQL injection poses a severe risk to data integrity and confidentiality. With a CVSS score of 8.5, this vulnerability could allow an attacker to bypass authentication, extract sensitive user information, or modify critical application data, potentially leading to full system compromise.

Remediation Plan

Immediate Action: Apply the latest vendor security patches as soon as they are made available to remediate the vulnerable code.

Proactive Monitoring: Enable detailed database query logging and monitor for unusual query structures or unauthorized access patterns within the database logs.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to block malicious payloads targeting the application interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this SQL injection flaw, it is imperative that administrators prioritize the identification and patching of all affected instances. Restricting database permissions for the application service account can help limit the potential blast radius until a formal update is applied.

---METADATA---
VENDOR: CIENA
PRODUCT: Navigator NCS, MCP, and Planner Plus OnPrem
AFFECTED_VERSIONS: CIENA Navigator NCS 8.1 prior to 8.1-P02 or 8.2; CIENA MCP prior to 8.0-P04 or 7.2-P07; CIENA Planner Plus OnPrem prior to 4.1-P01 or 4.2.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Ciena software products contain hidden system accounts with predictable default passwords, potentially allowing unauthorized access and privilege escalation.

Executive Summary:
Ciena Navigator NCS, MCP, and Planner Plus OnPrem contain hidden system accounts with default passwords that can be exploited for unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-5269

Affected Software: CIENA Navigator NCS, MCP, and Planner Plus OnPrem

Affected Versions: CIENA Navigator NCS 8.1 prior to 8.1-P02 or 8.2; CIENA MCP prior to 8.0-P04 or 7.2-P07; CIENA Planner Plus OnPrem prior to 4.1-P01 or 4.2.

Vulnerability: The vulnerability (CWE-1393) involves the presence of hidden system accounts with predictable default passwords. An attacker can leverage these accounts to gain initial access and subsequently escalate privileges within the affected Ciena product suite.

Business Impact

The CVSS score of 9.8 reflects the high risk posed by this vulnerability. Unauthorized access to network control suites allows attackers to potentially manipulate network traffic, gain internal system control, and disrupt critical infrastructure operations.

Remediation Plan

Immediate Action: Apply the vendor-provided patches: Navigator NCS (8.1-P02, 8.2 or later), MCP (7.2-P07, 8.0-P04 or later), or Planner Plus OnPrem (4.1-P01, 4.2 or later).

Proactive Monitoring: Audit system account activity and search for any logins associated with default or undocumented service accounts.

Compensating Controls: Restrict network access to management interfaces to authorized IP addresses only and disable any unnecessary service accounts if possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning due to the potential for privilege escalation and long term persistence.

Analyst Recommendation

This vulnerability requires immediate attention to prevent unauthorized access via legacy or hidden administrative accounts. Organizations should coordinate with Ciena support to apply the recommended patches for the specific versions identified.

---METADATA---
VENDOR: CIENA
PRODUCT: 6500 S-Series
AFFECTED_VERSIONS: CIENA 6500 S-Series: R16.96 and prior; 6500 T-Series: R16.1 and prior; PTS: R16.1 and prior; CPL: R12.63 and prior
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical authentication bypass vulnerability in the default SFTP server component of multiple Ciena products allows remote, unauthenticated attackers to gain unauthorized access to the filesystem.

Executive Summary:
A critical authentication bypass in the SFTP component of multiple Ciena products allows unauthenticated remote attackers to gain full unauthorized filesystem access.

Vulnerability Details

CVE-ID: CVE-2026-5268

Affected Software: CIENA 6500 S-Series, 6500 T-Series, PTS, and CPL

Affected Versions: CIENA 6500 S-Series: R16.96 and prior; 6500 T-Series: R16.1 and prior; PTS: R16.1 and prior; CPL: R12.63 and prior

Vulnerability: The vulnerability exists within the default SFTP server component, which fails to properly validate credentials. This allows an unauthenticated, remote attacker to bypass security controls and interact with the filesystem.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe risk of data compromise and unauthorized system modification. An attacker could read sensitive system configuration files or modify critical binaries, leading to total loss of confidentiality and integrity for the affected network hardware.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware updates for the affected Ciena products as detailed in the official security advisory.

Proactive Monitoring: Monitor SFTP connection logs for unusual source IPs and unexpected file transfer activity on management interfaces.

Compensating Controls: Disable SFTP access on management interfaces if not required, or restrict access via firewall rules to dedicated, hardened management subnets.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous as it requires no authentication to exploit. Security teams must ensure all impacted Ciena devices are updated immediately to prevent unauthorized remote access to critical infrastructure components.

---METADATA---
VENDOR: SJCAM
PRODUCT: SJ4000-Air
AFFECTED_VERSIONS: SJ4000-Air V1.4C and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in SJCAM SJ4000-Air cameras allows arbitrary code execution through the processing of maliciously crafted FEX files.

Executive Summary:
A critical arbitrary code execution vulnerability in SJCAM SJ4000-Air cameras allows unauthenticated attackers to gain full control over the device via crafted firmware files.

Vulnerability Details

CVE-ID: CVE-2026-52656

Affected Software: SJCAM SJ4000-Air

Affected Versions: V1.4C and earlier

Vulnerability: The device firmware contains a flaw in how it handles FEX files. An unauthenticated attacker can supply a specially crafted file to trigger code execution at the system level, leading to total compromise of the camera.

Business Impact

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability, as it allows for full remote system compromise without authentication. If deployed in sensitive environments, these cameras could be weaponized to monitor physical premises or serve as an entry point for further attacks on the internal network.

Remediation Plan

Immediate Action: Contact the vendor for specific firmware update instructions, as no public patch version is currently identified.

Proactive Monitoring: Isolate affected camera devices from critical production networks and monitor for unexpected outbound communication or unauthorized configuration changes.

Compensating Controls: Place the devices behind a restrictive firewall and disable any remote management features that are not strictly necessary for operation.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via GitHub.

Analyst Notes: As of July 26, 2026, there is no public information indicating active exploitation in the wild. However, the presence of a public proof-of-concept repository demonstrates that the exploit path is well understood by the security research community.

Analyst Recommendation

This is a critical vulnerability that grants an attacker complete control over the affected hardware. Because there is currently no confirmed patch, users should prioritize network isolation of these devices to mitigate the risk of remote exploitation until the manufacturer provides a secure firmware update.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-1253
AFFECTED_VERSIONS: D-Link DIR-1253 v.1.0.1.250923.142435
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in D-Link DIR-1253 allows unauthenticated attackers to manipulate the etc/shadow component file to gain unauthorized system access.

Executive Summary:
A critical privilege escalation vulnerability in D-Link DIR-1253 firmware allows unauthenticated attackers to compromise the system, posing a severe security risk.

Vulnerability Details

CVE-ID: CVE-2026-52533

Affected Software: D-Link DIR-1253

Affected Versions: D-Link DIR-1253 v.1.0.1.250923.142435

Vulnerability: This is a privilege escalation vulnerability involving the etc/shadow component file. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector PR:N.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation allows an attacker to gain elevated privileges on the affected device, potentially leading to total system compromise, unauthorized data access, and the ability to execute arbitrary commands. This poses a significant risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: Update the device firmware to the latest version as specified in the vendor security bulletin.

Proactive Monitoring: Monitor device access logs for unauthorized administrative logins or suspicious file modification attempts involving system configuration files.

Compensating Controls: Ensure the management interface of the device is not exposed to the public internet and restrict access to trusted internal IP addresses.

Exploitation Status

Public Exploit Available: Yes, a public Proof-of-Concept exists per the provided references.

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation and critical impact.

Analyst Recommendation

Given the critical CVSS score and the availability of proof-of-concept code, this vulnerability requires immediate attention. Administrators must prioritize applying the latest firmware update provided by D-Link to mitigate the risk of unauthorized privilege escalation and system takeover.

---METADATA---
VENDOR: Wgcloud
PRODUCT: Wgcloud
AFFECTED_VERSIONS: 3.6.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in Wgcloud 3.6.4 allows unauthenticated remote attackers to escalate privileges via the PortInfoMapper.xml file.

Executive Summary:
A critical SQL injection vulnerability in Wgcloud 3.6.4 poses a severe risk of total system compromise and unauthorized privilege escalation by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-52472

Affected Software: Wgcloud Wgcloud

Affected Versions: 3.6.4

Vulnerability: The software contains a SQL injection flaw within the PortInfoMapper.xml file that permits unauthenticated remote attackers to execute arbitrary database commands. This vulnerability allows for unauthorized privilege escalation and full control over the database backend.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for complete system compromise without requiring user interaction or prior authentication. Successful exploitation may result in the exfiltration of sensitive data, complete loss of database integrity, and total service disruption, leading to significant financial and reputational damage.

Remediation Plan

Immediate Action: Since a specific patch version is currently unavailable, users should isolate affected Wgcloud instances from public networks and restrict access to authorized management segments only.

Proactive Monitoring: Security teams should monitor database logs for suspicious SQL syntax, unexpected query patterns, or unauthorized administrative privilege escalation attempts originating from the application service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application, which may provide a temporary virtual patch against exploitation.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept exists as referenced in the provided GitHub repository.

Analyst Notes: As of July 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible to remote attackers, necessitating immediate defensive measures.

Analyst Recommendation

Given the critical severity and the existence of a proof-of-concept, this vulnerability represents an urgent security risk. Organizations must prioritize restricting network access to the affected Wgcloud component and remain alert for vendor updates to apply the necessary patches as soon as they become available.

---METADATA---
VENDOR: Crocus
PRODUCT: Crocus
AFFECTED_VERSIONS: Crocus <= 1.3.44
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the Crocus RecordStateMapper.xml file allows remote, unauthenticated attackers to execute arbitrary SQL commands and escalate privileges.

Executive Summary:
A critical SQL injection vulnerability in Crocus allows unauthenticated remote attackers to execute arbitrary SQL queries, leading to full database compromise.

Vulnerability Details

CVE-ID: CVE-2026-52470

Affected Software: Crocus

Affected Versions: Crocus <= 1.3.44

Vulnerability: This vulnerability resides in the RecordStateMapper.xml file where user-supplied input is improperly concatenated into SQL queries. An unauthenticated attacker can exploit this over the network to inject arbitrary SQL commands.

Business Impact

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability. By bypassing authentication to execute arbitrary SQL, an attacker can extract, modify, or delete sensitive business data, leading to severe reputational damage and potential loss of operational continuity.

Remediation Plan

Immediate Action: Update to a version of Crocus beyond 1.3.44 as soon as the vendor provides the updated package.

Proactive Monitoring: Review database audit logs for any unexpected query execution or unauthorized access to sensitive tables.

Compensating Controls: Implement strict input validation and parameterized queries at the application layer, and deploy a WAF to block malicious SQL injection payloads at the network edge.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists.

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous because it requires no privileges or user interaction to facilitate full database compromise.

Analyst Recommendation

This is a critical security flaw that requires immediate attention. Security teams must verify their current version of Crocus and apply the latest available updates to mitigate the risk of remote database exploitation.

---METADATA---
VENDOR: Crocus
PRODUCT: Crocus
AFFECTED_VERSIONS: Crocus <= 1.3.44
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the Crocus DeviceInfoMapper.xml file allows remote, unauthenticated attackers to execute arbitrary SQL commands and escalate privileges.

Executive Summary:
A critical SQL injection vulnerability in Crocus allows unauthenticated remote attackers to achieve full database compromise and escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-52469

Affected Software: Crocus

Affected Versions: Crocus <= 1.3.44

Vulnerability: The application is susceptible to SQL injection via the DeviceInfoMapper.xml file. This allows an unauthenticated remote attacker to inject arbitrary SQL statements, leading to unauthorized database interaction and privilege escalation.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Successful exploitation provides an attacker with complete control over the underlying database, enabling them to steal sensitive information, modify data, or gain administrative access to the application, resulting in a total compromise of the affected system.

Remediation Plan

Immediate Action: Upgrade Crocus to a version greater than 1.3.44 to patch the vulnerable mapper file.

Proactive Monitoring: Monitor database query logs for unusual or malformed SQL statements that deviate from standard application behavior.

Compensating Controls: Use a Web Application Firewall (WAF) to filter incoming requests for common SQL injection patterns and sanitize input before it reaches the application backend.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists.

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication and the potential for total system impact.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate patching is required. Organizations should treat this as a high-priority remediation task to avoid total database compromise and unauthorized administrative access.

---METADATA---
VENDOR: Open Library Foundation
PRODUCT: VuFind
AFFECTED_VERSIONS: 11.0.3, 4.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Open Library Foundation VuFind v11.0.3 and v4.1 suffer from an incorrect access control vulnerability where requests continue processing despite failed authorization checks.

Executive Summary:
A critical access control flaw in VuFind allows unauthenticated attackers to trigger unauthorized function execution despite receiving an initial access denied response.

Vulnerability Details

CVE-ID: CVE-2026-52466

Affected Software: Open Library Foundation VuFind

Affected Versions: 11.0.3, 4.1

Vulnerability: This is an improper access control vulnerability located in the VuFind Controller AbstractBase::validateAccessPermission method. The application fails to terminate request processing after identifying that controller level permissions do not grant access, allowing the intended function to execute regardless of the authorization failure.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized data access, modification, or system-wide disruption. With a CVSS score of 9.8, the potential for total impact on confidentiality, integrity, and availability is high, posing a significant risk to the security posture of library systems utilizing this software.

Remediation Plan

Immediate Action: Monitor the vendor security advisory at https://vufind.org/wiki/security:cve-2026-52466 for the release of a patch and apply it immediately upon availability.

Proactive Monitoring: Review application and access logs for unusual patterns of denied requests followed by successful administrative function execution.

Compensating Controls: Implement strict network perimeter controls and Web Application Firewall (WAF) rules to restrict access to the application to known, trusted IP ranges until a patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the failure of the security gatekeeper logic.

Analyst Recommendation

Given the critical nature of this vulnerability and its potential for total system compromise, organizations should treat this as a high-priority item. Administrators must maintain awareness of the vendor security portal and prioritize the deployment of the official fix as soon as it is released.

---METADATA---
VENDOR: MIA Technology
PRODUCT: MIA Technology Inc (Software)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A CSV formula injection vulnerability in MIA Technology software allows attackers to execute arbitrary system commands when a malicious CSV file is opened.

Executive Summary:
MIA Technology software is vulnerable to CSV formula injection, which can facilitate remote command execution on a user's local system.

Vulnerability Details

CVE-ID: CVE-2026-5242

Affected Software: MIA Technology MIA Technology Inc

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the improper neutralization of formula elements within CSV files. An attacker can craft a malicious CSV file that, when opened in spreadsheet software, triggers unauthorized commands or data exfiltration.

Business Impact

With a CVSS score of 8.8, this flaw poses a significant danger to client-side environments. Successful exploitation could lead to data theft, malware infection, or unauthorized system access, making it a major concern for any organization that processes user-uploaded CSV files.

Remediation Plan

Immediate Action: Install the latest security update from the vendor to remediate the CSV handling logic.

Proactive Monitoring: Monitor for unexpected process launches or network connections following the opening of generated CSV reports.

Compensating Controls: Educate users on the risks of opening untrusted files and implement input validation on the server side to sanitize CSV output content.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

MIA Technology users should prioritize updating their software to the latest version. In the interim, organizations should implement strict controls over file uploads and sanitize all data exported into CSV formats to prevent the injection of malicious formulas.

---METADATA---
VENDOR: Menyoo
PRODUCT: MenyooSP
AFFECTED_VERSIONS: Menyoo 2.0 Versions before commit 729aa48
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A directory traversal vulnerability in Menyoo 2.0 allows a local attacker to execute arbitrary code via multiple file management functions.

Executive Summary:
A critical directory traversal vulnerability in Menyoo 2.0 allows local attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-52349

Affected Software: Menyoo MenyooSP

Affected Versions: Menyoo 2.0 Versions before commit 729aa48

Vulnerability: This is a directory traversal vulnerability that stems from inadequate input validation and path sanitization within the Spooner, VehicleSpawner, and WeaponOptions file management functionalities. It requires a local attacker to interact with these specific components to trigger the flaw and execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability permits a local user to execute arbitrary code on the host system. Given the CVSS score of 7.8, the potential for full system compromise is significant, potentially leading to unauthorized data access, lateral movement, or complete loss of system integrity.

Remediation Plan

Immediate Action: Upgrade to the latest version of Menyoo or apply the patch provided in commit 729aa48 immediately.

Proactive Monitoring: Monitor local system logs for unusual file access patterns or attempts to access restricted directory paths via the affected management functions.

Compensating Controls: Restrict local user access to the application directories and ensure that the software is executed with the minimum necessary privileges to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability allows for code execution, it is limited by the requirement for local access.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent local privilege escalation or system takeover. Administrators should prioritize applying the fix provided in commit 729aa48 to neutralize the directory traversal path.

---METADATA---
VENDOR: cool-team-official
PRODUCT: cool-admin-java
AFFECTED_VERSIONS: 8.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the order() method of CrudOption.java within cool-admin-java 8.0.0 allows unauthenticated attackers to compromise the database.

Executive Summary:
A critical SQL injection vulnerability in cool-admin-java 8.0.0 allows unauthenticated remote attackers to gain full control over the database.

Vulnerability Details

CVE-ID: CVE-2026-52348

Affected Software: cool-admin-java

Affected Versions: 8.0.0

Vulnerability: This vulnerability is a SQL injection flaw found in the order() method of CrudOption.java. It allows an unauthenticated remote attacker to execute arbitrary SQL commands, resulting in full impact to confidentiality, integrity, and availability.

Business Impact

The CVSS score of 9.8 indicates a critical risk to the entire application stack. Successful exploitation grants an attacker the ability to read, modify, or delete database contents, which could lead to a total compromise of the application and its underlying data.

Remediation Plan

Immediate Action: Check the vendor repository for security updates and apply the latest version once available to address the flawed method.

Proactive Monitoring: Monitor database query logs for evidence of SQL injection attempts, such as unexpected syntax or commands originating from the web application layer.

Compensating Controls: Use a Web Application Firewall with SQL injection protection enabled to inspect and block malicious payloads directed at the application.

Exploitation Status

Public Exploit Available: No (Note: While public proof-of-concept code exists, there is no confirmed weaponized exploit available.)

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of SQL injection.

Analyst Recommendation

Due to the critical nature of this SQL injection vulnerability and the existence of a public proof-of-concept, immediate action is required. Administrators should restrict access to the affected component and prioritize updating the application as soon as a fix is released by the maintainers.

---METADATA---
VENDOR: Form Notify
PRODUCT: Form Notify Plugin for WordPress
AFFECTED_VERSIONS: Up to and including 1.1.10
---END_METADATA---

Description Summary:
The Form Notify plugin for WordPress suffers from an authentication bypass vulnerability due to improper verification of user-controlled cookie data during LINE OAuth login.

Executive Summary:
An authentication bypass vulnerability in the Form Notify plugin for WordPress allows unauthenticated attackers to hijack any user account, including administrator accounts.

Vulnerability Details

CVE-ID: CVE-2026-5229

Affected Software: Form Notify, Form Notify Plugin for WordPress

Affected Versions: Up to and including 1.1.10

Vulnerability: This vulnerability occurs because the plugin trusts user-supplied cookie data to determine account identity during LINE OAuth flows. Unauthenticated attackers can manipulate the 'form_notify_line_email' cookie to impersonate any legitimate user.

Business Impact

The ability for an unauthenticated attacker to gain administrative access poses a critical risk to data integrity, confidentiality, and system availability. With a CVSS score of 9.8, this flaw represents a total compromise of the WordPress environment, potentially leading to unauthorized data exfiltration and complete site takeover.

Remediation Plan

Immediate Action: Update the Form Notify plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous authentication requests or irregular patterns associated with the LINE OAuth login flow.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious cookie modifications or unauthorized attempts to manipulate authentication parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity of 9.8 and the ease of exploitation, immediate patching is required. Administrators should verify their current version and update the Form Notify plugin immediately to prevent unauthorized administrative access.

---METADATA---
VENDOR: Kurt Software Studio
PRODUCT: WriteUp Mobile App
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Kurt Software Studio WriteUp Mobile App contains an improper access control vulnerability that allows unauthorized users to access restricted application functionality.

Executive Summary:
An improper access control flaw in the Kurt Software Studio WriteUp Mobile App poses a critical risk by allowing unauthorized access to protected application functions.

Vulnerability Details

CVE-ID: CVE-2026-5228

Affected Software: Kurt Software Studio, WriteUp Mobile App

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application suffers from missing authorization checks, meaning that certain functions are not properly constrained by Access Control Lists (ACLs). This allows authenticated or potentially unauthenticated users to interact with features they should not have permissions to access.

Business Impact

This vulnerability creates a significant risk of unauthorized data access and potential manipulation of application logic. With a CVSS score of 8.8, this flaw could be leveraged to bypass security boundaries, leading to unauthorized disclosure of sensitive information or the performance of administrative actions by unauthorized parties.

Remediation Plan

Immediate Action: Check for and apply the latest security updates provided by Kurt Software Studio to ensure proper authorization enforcement.

Proactive Monitoring: Audit application activity logs to identify instances where users are accessing features that fall outside their defined roles or privilege levels.

Compensating Controls: If a patch is unavailable, restrict network access to the mobile backend services and ensure that API endpoints are secured by robust server-side authentication and authorization checks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authorization vulnerabilities are high-impact issues that require immediate attention. Security teams should verify their current version status and apply the latest vendor patches to ensure that all internal access control mechanisms are functioning as intended.

---METADATA---
VENDOR: MCMS
PRODUCT: MCMS
AFFECTED_VERSIONS: v.6.1.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in MCMS v.6.1.1 allows remote, unauthenticated attackers to retrieve sensitive information by manipulating the source parameter.

Executive Summary:
A high-severity information disclosure vulnerability in MCMS v.6.1.1 allows unauthenticated remote attackers to access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-52203

Affected Software: MCMS

Affected Versions: v.6.1.1

Vulnerability: The application is susceptible to sensitive information disclosure due to improper validation of the source parameter. This vulnerability is remotely exploitable by an unauthenticated attacker without requiring user interaction.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality. Unauthorized access to sensitive information can lead to severe reputational damage, regulatory non-compliance, and the exposure of proprietary or private user data stored within the system.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, verify with the vendor for the latest security release and apply it immediately.

Proactive Monitoring: Monitor server logs for suspicious requests involving the source parameter that appear to be attempting to traverse directories or access unauthorized files.

Compensating Controls: Implement input validation rules at the network perimeter or via a WAF to restrict or sanitize the source parameter, preventing unauthorized data retrieval attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation.

Analyst Recommendation

Organizations utilizing MCMS v.6.1.1 should treat this as a high-priority item. In the absence of a confirmed patch, users should restrict network access to the application to trusted sources only and monitor for any attempts to probe the source parameter.

---METADATA---
VENDOR: Softtr Information
PRODUCT: E-Commerce Pack
AFFECTED_VERSIONS: 0 through 30072026
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability exists in Softtr Information E-Commerce Pack, allowing unauthorized actions on behalf of a victim.

Executive Summary:
A high-severity Cross-Site Request Forgery vulnerability in the Softtr Information E-Commerce Pack could allow an unauthenticated attacker to perform unauthorized actions on behalf of a user.

Vulnerability Details

CVE-ID: CVE-2026-5219

Affected Software: Softtr Information E-Commerce Pack

Affected Versions: 0 through 30072026

Vulnerability: This is a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) where an unauthenticated attacker can trick a legitimate user into executing unwanted actions. The vulnerability relies on the victim interacting with a malicious site while authenticated to the target application.

Business Impact

The vulnerability carries a CVSS score of 8.3, indicating a high risk of significant impact. Successful exploitation could lead to unauthorized administrative actions, data modification, or account compromise, potentially resulting in severe operational disruption and reputational damage.

Remediation Plan

Immediate Action: Update the Softtr Information E-Commerce Pack to the version containing the security fix as specified in the official vendor advisory.

Proactive Monitoring: Review web server and application access logs for suspicious patterns or unexpected state-changing requests originating from external referrers.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and validate request headers and enforce CSRF protection tokens for all sensitive endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CSRF flaws are inherently dependent on social engineering or malicious cross-site scripts to execute, increasing the importance of user awareness and browser security policies.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized state changes, it is critical to prioritize this update. Administrators should verify their current deployment version against the vendor documentation and apply the recommended patch immediately to prevent potential account or system takeover.

---METADATA---
VENDOR: Acyba
PRODUCT: AcyMailing
AFFECTED_VERSIONS: 0 through 10.8.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the AcyMailing WordPress plugin allows authenticated users to perform unauthorized actions.

Executive Summary:
A critical missing authorization flaw in the AcyMailing WordPress plugin could allow authenticated users to perform unauthorized actions, potentially leading to full site compromise.

Vulnerability Details

CVE-ID: CVE-2026-5200

Affected Software: Acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

Affected Versions: 0 through 10.8.2

Vulnerability: The plugin suffers from a missing authorization vulnerability (CWE-862) that permits authenticated users with low privileges to perform functions reserved for higher-privileged accounts. The CVSS vector indicates that while the attacker must be authenticated, they can perform actions with significant impact on confidentiality, integrity, and availability.

Business Impact

The vulnerability allows for unauthorized administrative actions within the marketing automation platform, which could lead to the exposure of sensitive subscriber data or the manipulation of newsletter content. With a CVSS score of 8.8, this represents a significant risk to site integrity and organizational reputation, as it could be leveraged to distribute malicious content to the entire subscriber base.

Remediation Plan

Immediate Action: Update the AcyMailing plugin to version 10.9.0 or later immediately.

Proactive Monitoring: Review administrative access logs for suspicious account activity or unauthorized changes to marketing campaigns and subscriber lists.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block requests that attempt to access restricted plugin functions without proper authorization.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation within the WordPress environment.

Analyst Recommendation

The risk posed by this vulnerability is high, particularly for organizations managing large subscriber lists. Administrators must prioritize updating the AcyMailing plugin to version 10.9.0 to close the authorization gap and prevent potential data exposure or unauthorized marketing activities.

---METADATA---
VENDOR: Oneblog
PRODUCT: Oneblog
AFFECTED_VERSIONS: Oneblog V2.3.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Oneblog V2.3.9 is vulnerable to an information disclosure flaw in its API components, allowing unauthenticated remote attackers to access sensitive data.

Executive Summary:
A high-severity information disclosure vulnerability in Oneblog V2.3.9 enables unauthenticated remote attackers to extract sensitive data from the application.

Vulnerability Details

CVE-ID: CVE-2026-51937

Affected Software: Oneblog

Affected Versions: Oneblog V2.3.9

Vulnerability: The application contains an information disclosure vulnerability within the RestApiController.java, JsApiTicketComponent.java, and GetAccessTokenComponent.java components. This flaw allows unauthenticated remote attackers to bypass access controls and retrieve sensitive system information.

Business Impact

The exploitation of this vulnerability could lead to the exposure of sensitive internal data, potentially facilitating further attacks against the application or the underlying infrastructure. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to data confidentiality, necessitating immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Review the issue tracker at https://github.com/zhangyd-c/OneBlog/issues/43 for developer guidance and apply any available security patches or configuration changes.

Proactive Monitoring: Review web server and application API logs for anomalous, high-frequency requests targeting the vulnerable Java components.

Compensating Controls: Implement Web Application Firewall (WAF) rules to block unauthorized access attempts to the identified API endpoints.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Jul 6, 2026, public Proof-of-Concepts are available for this vulnerability. Given the ease of exploitation, the risk of active exploitation is elevated.

Analyst Recommendation

Organizations utilizing Oneblog V2.3.9 should treat this as a high-priority incident. Apply vendor-recommended mitigations immediately and restrict network access to the affected API endpoints until a formal patch is deployed.

---METADATA---
VENDOR: docuForm GmbH
PRODUCT: FSM Client
AFFECTED_VERSIONS: v.11.11c
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
A vulnerability in the docuForm GmbH FSM Client v.11.11c login.php component allows remote attackers to perform user enumeration.

Executive Summary:
A user enumeration vulnerability in docuForm GmbH FSM Client v.11.11c allows unauthorized attackers to identify valid accounts, facilitating further targeted attacks.

Vulnerability Details

CVE-ID: CVE-2026-51926

Affected Software: docuForm GmbH FSM Client

Affected Versions: v.11.11c

Vulnerability: The application's authentication mechanism, specifically within the login.php component, is susceptible to user enumeration. By analyzing variations in server responses, an unauthenticated attacker can confirm the existence of specific usernames within the system.

Business Impact

While this vulnerability has a CVSS score of 7.5, its primary impact is as a precursor to more severe attacks. By successfully enumerating valid usernames, attackers can significantly increase the efficiency of brute-force or credential-stuffing attacks, potentially leading to full account takeover and unauthorized access to sensitive information.

Remediation Plan

Immediate Action: Reach out to the vendor, docuForm GmbH, for the latest security patches addressing authentication logic flaws.

Proactive Monitoring: Monitor authentication logs for high volumes of failed login attempts or repeated requests that target enumeration, which may indicate an ongoing reconnaissance effort.

Compensating Controls: Implement account lockout policies, rate limiting, and multi-factor authentication (MFA) to mitigate the risk of automated credential attacks facilitated by this enumeration flaw.

Exploitation Status

Public Exploit Available: No confirmed public exploit is currently available.

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Although this vulnerability does not grant direct access, it provides attackers with the intelligence necessary to mount more damaging campaigns. Organizations should prioritize the application of any vendor-supplied patches and enhance their authentication security posture immediately.

---METADATA---
VENDOR: docuForm GmbH
PRODUCT: Client
AFFECTED_VERSIONS: v.11.11c
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
An Insecure Direct Object Reference (IDOR) in docuForm GmbH Client v.11.11c allows remote attackers with low privileges to execute arbitrary code and access other users' data.

Executive Summary:
An Insecure Direct Object Reference (IDOR) vulnerability in docuForm GmbH Client v.11.11c permits low-privileged attackers to execute arbitrary code and compromise sensitive user data.

Vulnerability Details

CVE-ID: CVE-2026-51923

Affected Software: docuForm GmbH Client

Affected Versions: v.11.11c

Vulnerability: The software contains an Insecure Direct Object Reference (IDOR) vulnerability within its user settings component. This flaw allows an authenticated attacker with low privileges to manipulate object references to execute arbitrary code and gain unauthorized access to data belonging to other users.

Business Impact

The CVSS score of 8.1 reflects the high risk associated with this vulnerability, as it allows for both remote code execution and unauthorized data access. A successful compromise could lead to a full breach of user confidentiality, system-wide unauthorized actions, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Contact docuForm GmbH to obtain the latest security updates or patches for the Client software.

Proactive Monitoring: Review application access logs for unusual patterns, such as account identifiers that do not correspond to the current user session or unexpected code execution attempts.

Compensating Controls: Implement strict identity and access management controls and ensure that the application is running with the principle of least privilege to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: No confirmed public exploit is currently available.

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The severity of this flaw requires immediate attention from security teams. Organizations should prioritize updating the affected software as soon as a patch is released to prevent the potential for arbitrary code execution and unauthorized data retrieval.