CVE-2026-9764

IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...

HostCMS Path Traversal

The vulnerability in the HostCMS website management system is related to improper restriction of the path name for the directory. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

DIAFAN.CMS SQL Injection

The vulnerability in the DIAFAN.CMS content management system is related to improper handling of SQL query structures. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

InstantCMS Unrestricted Upload Arbitrary Code

The InstantCMS content management system vulnerability is related to unrestricted upload of malicious files. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

1C-Bitrix Before and After Photos Code Execution

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

CodeScoring Template Code Execution

The vulnerability of the CodeScoring software development platform lies in the lack of measures to neutralize special elements within the template creation mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Ascon.Pilot.WinService Auth Bypass Code Execution

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Telecom MG Code Execution

The vulnerability of the VoIP gateway software of Telecom MG is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

FOQUZ Platform SQL Injection

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

pg_dump Code Execution

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CrocoTime employee working time management system Code Execution

The vulnerability in the CrocoTime employee working hours tracking system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-124467

OpenEMR versions before 8.4.0 are vulnerable to Remote Code Execution due to a local file inclusion in the ESign router (library/ESign/Router.php). The software fails to sanitize the module parameter, which is used in a require_once statement for /Controller.php. Additionally, the fax module (fax...

EUVD-2026-119550

OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated filepath parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web...

CVE-2026-124450

OpenEMR versions prior to 8.3.0 are vulnerable to broken access control and path traversal within the fax/sms module's disposeDocument action. The root cause is an unvalidated file_path parameter , which allows authenticated low-privilege users to read sensitive files like sqlconf.php to recover ...

CVE-2026-124430

Craft CMS versions 5.10.0 before 5.11.2 are vulnerable to Remote Code Execution (RCE) . The issue stems from an HMAC-signed Twig template signing oracle at the app/render-elements endpoint, which allows non-administrator control panel users to obtain signed templates. An attacker can submit the s...

EUVD-2026-119570

Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter,...

CVE-2026-114432

The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian ...

CVE-2026-114432 Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename

The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian ...

CVE-2026-114432

The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian ...

EUVD-2026-119468

The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian ...