News & Sicurezza

CVE ID :CVE-2026-1867 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6 allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6's settings, it is possible for an unauthenticated attacker to export and download all of the form data/settings, including the administrator's email address. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1753 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register). Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-27842 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device configuration. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-24448 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2023-27573 Published : March 11, 2026, 6:17 a.m. | 1 hour, 1 minute ago Description :netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment. Severity: 9.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

March 2026 Patch Tuesday: Eight Critical Vulnerabilities and Two Publicly Disclosed Among 82 CVEs Patched Microsoft has addressed 82 vulnerabilities in its March 2026 security update release. These include two publicly disclosed vulnerabilities and eight Critical vulnerabilities. This month's leading risk ... Read more Published Date: Mar 11, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-26144 CVE-2026-26127 CVE-2026-26113 CVE-2026-26110 CVE-2026-21262 CVE-2026-26125 CVE-2026-26124 CVE-2026-26122 CVE-2026-23651 CVE-2026-21536

Gogs Vulnerability Enables Attackers to Silently Overwrite Large File Storage Objects Gogs Vulnerability Overwrite Large File Storage Objects A critical security flaw has been discovered in a popular open-source, self-hosted Git service, allowing attackers to overwrite Large File Stora ... Read more Published Date: Mar 11, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-25921

Microsoft .NET 0-Day Vulnerability Enables Denial-of-Service Attacks Microsoft .NET 0-Day Vulnerability An emergency security update has been released to address a newly disclosed .NET Framework vulnerability, tracked as CVE-2026-26127. This security flaw allows unauth ... Read more Published Date: Mar 11, 2026 (23 hours, 27 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-26127

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.

CVE ID :CVE-2026-2413 Published : March 11, 2026, 5:18 a.m. | 2 hours ago Description :The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVE ID :CVE-2025-13067 Published : March 11, 2026, 5:17 a.m. | 2 hours ago Description :The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...