medium · CVSS v3 4.3 · CVSS v4 5.3

CVE-2026-122151

A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the fi…

Description

A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.

Scores

Severity
medium
CVSS v2
5
CVSS v3
4.3
CVSS v4
5.3
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-122049

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.

View analysis

medium

CVE-2026-105971

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.

View analysis

medium

CVE-2026-90963

The Essential Real Estate WordPress plugin (v<5.3.5) lacks authorization checks on an AJAX action, enabling unauthenticated users to retrieve full details of unpublished property listings, including agent contact information. This flaw exposes sensitive data that should remain private. The vulnerability is medium severity (CVSS 5.3).

View analysis

medium

CVE-2026-122052

A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible.

View analysis