#High
All CosmicBytez Labs articles tagged #High, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-92244: Unauthenticated Stored XSS in WooCommerce PDF Invoices Plugin
High-severity stored XSS (CVSS 7.2) in PDF Invoices & Packing Slips for WooCommerce, 300K+ sites, triggered via guest checkout fields.
- Security
CVE-2026-15162: WordPress Object Sync for Salesforce — SQLi via REST API
High-severity unauthenticated SQL injection in Object Sync for Salesforce plugin allows attackers to extract data via a misconfigured REST API push endpoint.
- Security
CVE-2026-13339: CubeWP Framework WordPress Plugin Directory Traversal (CVSS 7.5)
A high-severity directory traversal vulnerability in the CubeWP Framework plugin for WordPress allows unauthenticated attackers to read arbitrary files on...
- Security
CVE-2026-14635: Unrestricted File Upload RCE in CodeIgniter Ecommerce Bootstrap
A high-severity unrestricted file upload vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap allows authenticated vendor users to upload...
- Security
CVE-2026-14637: PHP Deserialization RCE in CodeIgniter Ecommerce Bootstrap Shopping Cart
A high-severity PHP deserialization vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap allows attackers to inject malicious serialized...
- Security
CVE-2026-14641: Remote SQL Injection in SourceCodester Class and Exam Timetabling System
A high-severity SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to dump the...
- Security
CVE-2026-14642: Remote SQL Injection in SourceCodester Timetabling System edit_class2.php
A high-severity SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to fully...
- Security
CVE-2026-10167: School Student Management System Cookie Auth Bypass
A high-severity authentication bypass vulnerability in OUSL-GROUP BrinaryBrains School Student Management System allows manipulation of the sign_auth_cookie…
- Security
CVE-2026-22753: Spring Security Filter Chain Bypass via PathPattern Matcher
A high-severity flaw in Spring Security allows security filter chains to silently fail to match requests when PathPatternRequestMatcher.Builder is used to...
- Security
CVE-2025-2749: Kentico Xperience Path Traversal
Kentico Xperience contains a path traversal vulnerability allowing an authenticated user's Staging Sync Server to upload arbitrary data to relative path...
- Security
CVE-2026-4498: Kibana Fleet Plugin Privilege Escalation
A high-severity privilege escalation flaw in Kibana's Fleet plugin debug route handlers allows authenticated users with limited Fleet sub-feature...
- Security
CVE-2026-5016: elecV2P SSRF Vulnerability in URL Handler
A server-side request forgery vulnerability in elecV2P up to version 3.8.3 allows remote attackers to manipulate the eAxios function via the /mock...
- Security
CVE-2025-43510: Apple Multiple Products Improper Locking
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability allowing a malicious app to cause unexpected changes in...