Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:vitepos:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Vitepos (1a9b7d3d-7c7f-5873-ad09-b60e5e6ffeed) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14238 |
vulnerable | 2026-09-16 04:33:12.418386 |
Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report
The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
Published: 2026-08-10T06:00:18.768Z
Updated: 2026-08-11T14:56:20.081Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14237 |
vulnerable | 2026-09-16 04:33:11.886500 |
Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
Published: 2026-08-10T06:00:18.586Z
Updated: 2026-08-11T14:54:39.645Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8157 |
vulnerable | 2026-07-29 01:09:05.614256 |
Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
Published: 2026-06-22T06:00:02.475Z
Updated: 2026-06-22T12:48:54.354Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.