109816 matches found
CVE-2026-78276
CVE-2026-78276 affects the WordPress Fluent Boards Pro plugin, versions 2.0.11 and earlier , where an Editor-level user can perform PHP Object Injection , leading to potential high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.2 / HIGH ). The vulnerability is network-re...
EUVD-2026-66939
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78257
CVE-2026-78257 is a PHP Object Injection vulnerability in the WordPress plugin Booking and Rental Manager for WooCommerce (versions ≤ 2.7.5), discovered by daroo and rated CVSS 8.8 (High) by Patchstack. The flaw allows a user with Contributor privilege to exploit the injection over the network wi...
CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
EUVD-2026-66992
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability
Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...
Exploit for CVE-2026-38526
🏴☠️ HTB Labs - Nexus English 🇺🇸 | Español 🇪🇸 English...
CVE-2026-77991
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
All-Line Equipment Company Fuel-Boss
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...
EUVD-2026-66866
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
CVE-2026-77991
Joomla Event Manager (a Joomla extension from joomlaeventmanager.net) versions prior to 5.0.1 are vulnerable to privileged remote code execution due to a flaw in the administrator source model , which allows writing dangerous file types including PHP. An authenticated attacker with high privilege...
CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
PT-2026-82426
Name of the Vulnerable Software and Affected Versions Joomla Event Manager versions prior to 5.0.1 Description An issue in the administrator source model allows the upload of dangerous file types, including PHP files, which can lead to privileged remote code execution. Recommendations Update Joom...
CVE-2026-19092: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
CVE-2026-78292: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...