CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80239

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80238

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555

CVE-2026-27555 is a Local File Inclusion (LFI) vulnerability in the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker holding a valid user cookie can exploit it to achieve arbitrary PHP code execution on the device. The CVSS 3.1 base score is 8.8 (HIGH) , with network ...

CVE-2026-27554 Command Injection in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80230

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-76551

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

CVE-2026-76551

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

CVE-2026-76551 WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remot...

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. The tokens are roughly 31-bit , allowing remote unauthenticated attackers to guess them and confirm opt-ins, accept or...

EUVD-2026-80078

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

PT-2026-93349

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save iodd parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-92593: Improper Control of Generation of Code

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

CVE-2026-92591: Not Failing Securely

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...