CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

EUVD-2026-52180

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...

CVE-2025-15672 Chama < 1.0.13 - Unauthenticated PHP Object Injection

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other...

EUVD-2026-52168

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

PHP CGI v5.3.12/5.4.2 Remote Code Execution

sapi/cgi/cgimain.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string,...

PT-2026-67399

Name of the Vulnerable Software and Affected Versions Telenia Software TVox versions prior to 26.5.3 Telenia Software TVox versions prior to 24.9.21 Description An authentication bypass exists in the set env.php file. The redirectToLoginAdminIRequestHaveAccessToken function determines the current...

PT-2026-67455

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

Oracle Linux 8 : php:8.2 (ELSA-2026-47749)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47749 advisory. libzip php 8.2.32-1 - rebase to 8.2.32 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip Tenable has extracted the preceding description block...

PT-2026-67517

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.7.5 Description An authenticated attacker can execute arbitrary SQL commands through a SQL injection flaw in the CommentBat feature. The issue occurs via the id parameter. Recommendations At the moment, there is no...

PT-2026-67491

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is...

CVE-2026-16297: Deserialization of Untrusted Data

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...

CVE-2026-16250: Unrestricted Upload of File with Dangerous Type

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

CVE-2026-61524: Unrestricted Upload of File with Dangerous Type

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

CVE-2026-39932: Improper Neutralization of Directives in Dynamically Evaluated Code

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2025-15672: Deserialization of Untrusted Data

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other...

CVE-2026-69246: Incorrect Behavior Order: Validate Before Canonicalize

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

PT-2026-67109

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...

PT-2026-67435

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

Oracle Linux 10 : php (ELSA-2026-48170)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48170 advisory. 8.3.32-1 - rebase to 8.3.32 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

PT-2026-67501

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has...