CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

CVE-2026-56703 Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...

CVE-2026-56703

Adminer before 5.4.3 is affected by a remote code execution vulnerability in its SQLite query handling . The root cause is that the VACUUM INTO statement is not blocked despite ATTACH restrictions being in place, allowing an authenticated attacker to write arbitrary PHP code to chosen file paths ...

CVE-2026-56703 Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...

CVE-2026-56703 Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...

CVE-2026-56702

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702

Adminer versions prior to 5.4.3 are affected by an unrestricted file upload vulnerability in the AdminerFileUpload plugin. The root cause is a permissive default extension allowlist that allows authenticated users to upload PHP files by targeting columns ending in _path. When the uploadPath direc...

EUVD-2026-65200

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

EUVD-2026-65169

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

EUVD-2026-65167

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

EUVD-2026-65172

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-77138: Deserialization of Untrusted Data

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

CVE-2026-75574: Improper Neutralization of Special Elements Used in a Template Engine

The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...

PT-2026-81217

Name of the Vulnerable Software and Affected Versions Verdure Core versions prior to 1.3 Description The Verdure Core plugin for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of PH...

Linux Distros Unpatched Vulnerability : CVE-2026-77634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail heade...

PT-2026-81224

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The indexer of the extension uses the PHP unserialize function to process field values returned by content object rendering when transferring multi-value data fo...