CVE-2026-100512 WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

EUVD-2026-90218

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97291

The Schema & Structured Data for WP & AMP plugin for WordPress, versions

CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97256 WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

EUVD-2026-90215

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

CVE-2026-97256 WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

CVE-2026-97256

The Page Builder by SiteOrigin WordPress plugin, affecting versions

CVE-2026-103475 yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103474

The yii2-starter-kit software, through version 4.2.0 , contains an Unrestricted File Upload vulnerability in the backend storage upload actions. The root cause is a failure to validate file types, which allows authenticated users with the manager role to upload PHP files . An attacker can leverag...

CVE-2026-103229

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...

CVE-2026-103442 MergeAccount PHP object injection via session-key substitution

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

CVE-2026-103229 AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...

CVE-2026-103229 AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...

EUVD-2026-89996

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...

CVE-2026-103229

The AdithyaYelloju Restaurant-Management-System is vulnerable to an SQL injection within the Unauthenticated Action Script component. The flaw exists in the mysqli_query function of the admin/delete1.php file, where an attacker can manipulate the ID argument to execute arbitrary SQL commands. Thi...

CVE-2026-103229 AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...