Business and Enterprise Solutions

In FreeScout versions prior to 1.8.206 a critical severity vulnerability CVE-2026-27636 was detected. This vulnerability allows authenticated users to upload `.htaccess` files on Apache servers with `AllowOverride All`, bypassing file upload restrictions and enabling remote code execution. To address this issue, users should upgrade FreeScout to version 1.8.206 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27636.

In Dolibarr ERP/CRM version 10.0.1 a high severity vulnerability CVE-2019-25450 was detected. This vulnerability allows authenticated attackers to execute arbitrary SQL queries via POST parameters such as `actioncode`, `demand_reason_id`, and `availability_id` in the `card.php` endpoint, potentially exposing sensitive database information through boolean-based blind, error-based, or time-based blind SQL injection techniques. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2019-25450.

In PrestaShop versions prior to 8.2.4 and 9.0.3 a medium severity vulnerability CVE-2026-25597 was detected. This vulnerability allows attackers to perform time-based user enumeration in the front-office login form by measuring response time differences to determine whether a customer account exists. To address this issue, users should upgrade PrestaShop to versions 8.2.4, 9.0.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25597.

In WP FOFT Loader plugin for WordPress versions up to and including 2.1.39 a high severity vulnerability CVE-2026-1756 was detected. This vulnerability allows authenticated attackers with Author-level access or higher to upload arbitrary files due to improper file type validation in the `WP_FOFT_Loader_Mimes::file_and_ext` function, potentially enabling remote code execution on the affected site. To address this issue, users should upgrade WP FOFT Loader plugin to version 2.1.40 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1756.

In WaveSurfer-WP plugin for WordPress versions up to and including 2.8.3 a high severity vulnerability CVE-2026-1909 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the plugin’s audio shortcode `src` attribute, potentially executing scripts whenever a user accesses the affected page. To address this issue, users should upgrade WaveSurfer-WP plugin to version 2.8.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1909.

In Code Snippets plugin for WordPress versions up to and including 3.9.4 a medium severity vulnerability CVE-2026-1785 was detected. This vulnerability allows unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) against logged-in administrators, forcing them to download or update cloud snippets without their consent due to missing nonce validation in the `Cloud_Search_List_Table` class. To address this issue, users should upgrade Code Snippets plugin to version 3.9.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1785.

In Dolibarr versions up to and including 11.0.3 a medium severity vulnerability CVE-2020-36966 was detected. This vulnerability allows attackers to inject malicious scripts via the LDAP synchronization settings, specifically through the `host`, `slave`, and `port` parameters in `/dolibarr/admin/ldap.php`, potentially enabling arbitrary JavaScript execution and theft of user cookie information. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-36966.

In the Simple Calendar for Elementor plugin for WordPress versions up to and including 1.6.6 a medium severity vulnerability CVE-2026-1310 was detected. This vulnerability allows unauthenticated attackers to delete arbitrary calendar entries due to missing capability checks on the miga_ajax_editor_cal_delete function, which is hooked to the miga_editor_cal_delete AJAX action with both authenticated and unauthenticated access enabled. To address this issue, users should upgrade Simple Calendar for Elementor plugin to version 1.6.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1310.

In the Easy Replace Image plugin for WordPress versions up to and including 3.5.2 a medium severity vulnerability CVE-2026-1298 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to replace arbitrary image attachments on the site via the image_replacement_from_url function, which is hooked to the eri_from_url AJAX action, due to missing capability checks. To address this issue, users should upgrade Easy Replace Image plugin to version 3.5.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1298.