PT-2026-97712

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient validation of a display-style setting allows users with the Contributor role and above to perform Local File Inclusion LFI, which is a technique used to trick a...

CVE-2026-96745: Deserialization of Untrusted Data

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

PT-2026-98038

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver affected versions not specified Description Deserialization of untrusted data in the command monitoring support allows class names embedded in document content to be honored during the construction of monitoring event object...

PT-2026-98273

Name of the Vulnerable Software and Affected Versions php affected versions not specified Description The mysqlnd wire protocol parser reads fields from server packets without first verifying if the packet contains sufficient bytes. This allows a malicious or compromised MySQL server to send a...

PT-2026-98286

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The function php openssl matches wildcard name in ext/openssl/xp ssl.c contains an integer underflow in the length argument passed to memchr. This occurs when a TLS server certificate uses a...

PT-2026-98288

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description OpenSSL stream peer verification incorrectly handles certificate validation by falling back to the Common Name CN when no entries in the subjectAltName SAN match. According to RFC 6125, the CN...

PHP 8.3.x < 8.3.35 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.3.35. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.35 advisory. - Debian Linux - php8.2 - None php8.4 - None CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766,...

PHP 8.5.x < 8.5.11 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.5.11. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.11 advisory. - Debian Linux - php8.2 - None php8.4 - None CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766,...

PHP 8.4.x < 8.4.26 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.4.26. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.26 advisory. - Debian Linux - php8.2 - None php8.4 - None CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766,...

PHP 8.2.x < 8.2.34 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.2.34. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.34 advisory. - Debian Linux - php8.2 - None php8.4 - None CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766,...

CVE-2026-12227: Improper Control of Filename for Include/Require Statement in PHP Program

The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...

WordPress get_page_template() Code Execution

The vulnerability of the getpagetemplate function in the WordPress content management system is related to improper handling of file names for PHP functions like include or require. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

LibreNMS SNMP Unauthorized Access Cross-site

The vulnerability of the SNMP protocol implementation in the LibreNMS network monitoring system is related to deficiencies in the process of blocking outdated PHP templates. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information and perform...

PHP dns_get_record SSRF

The vulnerability of the dnsgetrecord function in the PHP programming language is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...

CVE-2026-95603

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603

The Reycob Product Import Export plugin for WordPress, specifically versions

CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

EUVD-2026-85506

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remo...