CVE-2026-34025

IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locations

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability in the login process. The application restricts user logins based on the IP address associated with a branch location, but the client IP address is derived from the HTTP X-Forwarded-For header when that header is present. An attacker with valid branch user credentials can manipulate the X-Forwarded-For header during login to spoof the expected branch IP address and obtain a valid authenticated session from an unauthorized network location.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34026

Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary files

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-controlled input without sufficient validation, allowing an authenticated attacker with any role or permission level to traverse out of the intended document directory and download arbitrary files accessible to the application. This includes, but is not limited to, application log files containing sensitive information and application binaries.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34027

Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload if this value contains an allowed string such as pdf, jpeg, tiff, or png. An authenticated attacker with any role or permission level can spoof the Content-Type value and upload arbitrary file content.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34028

Unauthenticated direct access to web data in Wertheim SafeController Software exposes files

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An unauthenticated attacker can directly access HTTP endpoints to download files from locations such as /Resources/CompanyId_[ID]/Audio/ and /SafeData/.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34029

Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll component. An attacker with access to the application files can reverse engineer the DLL and recover the hard-coded cryptographic key. This key can be used to decrypt the licence.whs file, which contains sensitive information about the licensing party and a second key that can be used to decrypt other configuration files.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34030

Improper branch-code validation in Wertheim SafeController Software allows file path manipulation

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path generation for uploaded files, profile pictures, and settings. An authenticated attacker with the settings_branches_manage privilege can include path traversal sequences in the branch code and influence the final filesystem location used by affected file operations. This can allow files to be stored in unintended locations, subject to service-account write permissions and branch-code length restrictions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-12057

DoS + Remote Code Execution via PDF JavaScript in Foxit AI

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Ai Foxit Ai

CVE-2016-20072

BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid

BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Bbsetheme Wordpress

Products

Bbs E-franchise Wordpress

CVE-2016-20073

Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php

Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mattkaye Wordpress

Products

Answer My Question Wordpress

CVE-2016-20077

WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php

WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Kaymeephotography Wordpress

Products

Photocart Link Wordpress

CVE-2016-20079

WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php

WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jamie Wordpress

Products

Dharma Booking Wordpress

CVE-2016-20080

WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php

WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_abspath parameter to read sensitive files like wp-config.php or execute remote code.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Brandfolder Wordpress

Products

Brandfolder Wordpress

CVE-2016-20082

WordPress Plugin Abtest Local File Inclusion via abtest_admin.php

WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Abtest Wordpress

Products

Abtest Wordpress

CVE-2016-20083

WordPress More Fields Plugin 2.1 Cross-Site Request Forgery

WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests to the options-general.php endpoint.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Henrikmelin Wordpress

Products

More Fields Wordpress

CVE-2018-25436

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Shipster Wordpress

Products

Baggage Freight Shipping Australia Wordpress

CVE-2026-5230

Improper Access Control in Mia Technologies' Pizzy Library

Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mia Technology

Products

Pizzy Library

CVE-2026-5233

Missing Rate Limiting in Mia Technologies' Pizzy Library

Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mia Technology

Products

Pizzy Library

CVE-2026-5242

Code Injection in Mia Technologies' Pizzy Library

Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mia Technology

Products

Pizzy Library

CVE-2026-49062

WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Engine

Products

Wordpress Faust.js

CVE-2026-49064

WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Stiofan Wordpress

Products

Getpaid Wordpress