📄 WordPress WP2Shell SQL Injection / Remote Code Execution

This Metasploit module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137...

CVE-2026-62873 Microsoft 365 Admin Center Elevation of Privilege Vulnerability

...

CVE-2026-62873

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-62873 Microsoft 365 Admin Center Elevation of Privilege Vulnerability

...

CVE-2026-62873

Microsoft 365 Admin Center is affected by CVE-2026-62873 due to improper verification of cryptographic signatures, enabling elevated privileges over a network for an unauthorized attacker. The vulnerability details provided across sources (NVD, ENISA EUVD, CVE listing, and MSRC) confirm the issue...

CVE-2026-70557

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

CVE-2026-63725

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-48085

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

CVE-2026-48081

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN can store javascript: URLs in the tenant links configuration website, imprint, privacyStatement. These values are returned to the patient-facing landin...

CVE-2026-45415

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csvcensus/censuslogs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatu...

CVE-2026-45378

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

GHSA-957R-QF9P-67XW Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

The create Twig function introduced in 5.9.0 allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry blocklist. SplFileObject is not in the blocklist, enabling arbitrary file read, including .env security key, DB credentials and the passwd file from...

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

The create Twig function introduced in 5.9.0 allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry blocklist. SplFileObject is not in the blocklist, enabling arbitrary file read, including .env security key, DB credentials and the passwd file from...

Incomplete List of Disallowed Inputs

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the create function in non-sandboxed template contexts. An attacker can access arbitrary files on the server filesystem by instantiating SplFileObject...

GHSA-2RP4-X2J7-QMCC Craft CMS: Stored XSS in the control panel via unescaped draft name

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...

EUVD-2026-54168

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

CVE-2026-48086

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

CVE-2026-48086

OpenReception’s appointment-booking software (pre‑1.0.2) allows a TENANT_ADMIN to promote themselves to GLOBAL_ADMIN via a single PUT to the role-update handler. The handler accepts GLOBAL_ADMIN from any tenant admin updating their own staff, with no policy enforcing that only an existing GLOBAL_...

CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...