CVE-2026-108961

Publié : 13 octobre 2026

Modifié : 13 octobre 2026

Score CVSS

6.3

MEDIUM

Description détaillée

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/PaddlePaddle/PaddleX/https://github.com/PaddlePaddle/PaddleX/issues/5210 https://github.com/PaddlePaddle/PaddleX/pull/5212 https://vuldb.com/cve/CVE-2026-108961 https://vuldb.com/submit/997956 https://vuldb.com/vuln/416780 https://vuldb.com/vuln/416780/cti

Dernières Vulnérabilités

CVE-2026-89271

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.

VOIR DÉTAILS

CVE-2026-89269

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

VOIR DÉTAILS

CVE-2026-54870

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.

VOIR DÉTAILS