Vulnerabilidades de Supsysticcom
CVEs publicadas que afetam produtos de Supsysticcom: 5 registro(s), com severidade, exploração e correções.
CVE-2026-14877
Média · 6.4
CWE-79 10/10/2026
Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-104023
Média · 4.9
CWE-89 10/10/2026
Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-96648
Média · 6.4
CWE-79 10/10/2026
Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature that grants lower-privileged users access to the dtgs_nonce required to reach the vulnerable updateRows action handler.
CVE-2026-4257
Crítica · 9.8
Alta · 48 Exploit público CWE-94 30/03/2026
Plugin Contact Form da Supsystic para WordPress: Injeção de Template no Servidor
O plugin Contact Form by Supsystic para WordPress está vulnerável a Injeção de Template do Lado do Servidor (SSTI), levando a Execução Remota de Código (RCE) em todas as versões até, e incluindo, a 1.7.36. Isso se deve ao plugin utilizar o mecanismo de templates Twig Twig_Loader_String sem sandboxing, combinado com a funcionalidade de preenchimento prévio cfsPreFill, que permite a usuários não autenticados injetar expressões Twig arbitrárias nos valores dos campos do formulário por meio de parâmetros GET. Isso torna possível que atacantes não autenticados executem funções PHP arbitrárias e comandos do sistema operacional no servidor, aproveitando o método registerUndefinedFilterCallback() do Twig para registrar callbacks PHP arbitrários.
CVE-2025-12089
Média · 6.5
CWE-22 13/11/2025
Data Tables Generator by Supsystic <= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).