CVE-2026-81891

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

CVE-2026-82394

Sulu , an open-source PHP CMS built on Symfony , contains an authorization bypass in its preview-link functionality. Prior to versions 2.6.25 and 3.0.8 , the methods PreviewLinkManager::generate() and PreviewLinkManager::revoke() fail to enforce the VIEW permission on the target resource. An auth...

CVE-2026-82394 Sulu: Fix authorization bypass when creating preview links

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in...

CVE-2026-62993

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-62993

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-62993

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-62993 Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-62993 Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-62993 Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-81891

elFinder (open-source web file manager) is vulnerable to remote code execution prior to version 2.1.70 . The flaw resides in checkExtractItems() in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, ...

CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

CVE-2026-82226

This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...

CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

EUVD-2026-68796

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

GHSA-8X3Q-JPJH-QH5C elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-81889

elFinder (open-source web file manager) contains an SSRF protection bypass in php/elFinder.class.php prior to version 2.1.70 . When PHP cURL is unavailable, get_remote_contents() falls back to fsock_get_contents(), which performs a second DNS resolution to $arr['host'] independent of the IP alrea...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...