110340 matches found
CVE-2026-14249 Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emddeletefile AJAX action. This is due to the emddeletefile handler deriving a PHP function name from the attacker-controlled $POST'path' parameter and invoking it dynamically...
CVE-2026-14249
The CVE refers to the WordPress plugin “Request a Quote” (versions up to and including 2.5.5). The vulnerability is a Code Injection via the emd_delete_file AJAX action. The handler derives a PHP function name from attacker-controlled $_POST['path'] and invokes it dynamically through a variable-f...
php:7.4 security update
An update is available for module.libzip, php-pear, php-pecl-xdebug, libzip, php, module.php-pecl-xdebug, php-pecl-rrd, module.php, module.php-pecl-apcu, module.php-pecl-rrd, php-pecl-zip, module.php-pecl-zip, module.php-pear, php-pecl-apcu. This update affects Rocky Linux 8. A Common Vulnerabili...
CVE-2026-57621: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Booktics = 1.0.21 versions...
CVE-2026-57748: Improper Control of Filename for Include/Require Statement in PHP Program
Contributor Local File Inclusion in Shopify = 1.0.0 versions...
PT-2026-54640
Name of the Vulnerable Software and Affected Versions Request a Quote versions prior to 2.5.6 Description The Request a Quote plugin for WordPress allows unauthenticated attackers to perform code injection. The issue occurs because the emd delete file function derives a PHP function name from the...
CVE-2026-57677: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce = 12.10.3 versions...
PT-2026-56962
Name of the Vulnerable Software and Affected Versions CodexThemes TheGem Theme Elements for Elementor versions prior to 5.11.2 Description An improper control of filenames for include/require statements allows for Local File Inclusion. Authenticated attackers with contributor-level access or high...
PT-2026-55198
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do image upload function where user-supplied input from the acceptFileTypes PO...
CVE-2026-57749: Improper Control of Filename for Include/Require Statement in PHP Program
Contributor Local File Inclusion in SportsPress Pro = 2.7.29 versions...
AlmaLinux 8 : php:7.4 (ALSA-2026:34354)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:34354 advisory. php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via improper...
php:7.4 security update
libzip 1.6.1-1 - update to 1.6.1 - enable lzma support php 7.4.33-4 - Fix XSS within status endpoint CVE-2026-6735 - Fix Stale SOAPGLOBALrefmap pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after header parsing failure with SOAPPERSISTENCESESSION CVE-2026-7261 - Fix Broken Apache map...
PT-2026-54951
Name of the Vulnerable Software and Affected Versions Database for Contact Form 7, WPforms, Elementor forms versions prior to 1.5.2 Description An arbitrary file copy issue exists in the create entry el function. The function retrieves the raw value from the Elementor Pro Form Record object for...
CVE-2026-27414: Deserialization of Untrusted Data
Contributor PHP Object Injection in Werkstatt = 4.8.3 versions...
CVE-2026-9145: Improper Limitation of a Pathname to a Restricted Directory
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the createentryel function in versions up to, and including, 1.5.1. The function reads rawvalue from Elementor Pro's FormRecord object for upload-type fields and passes it...
CVE-2026-58467: Improper Limitation of a Pathname to a Restricted Directory
Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATHINFO derived from REQUESTURI in filesystem path construction without containment checks...
PT-2026-54976
Contributor PHP Object Injection in Werkstatt = 4.8.3 versions...
PT-2026-55875
Name of the Vulnerable Software and Affected Versions PHP version 8.2 Description A failure to establish a TLS handshake the process where a client and server authenticate each other and establish encryption keys with a remote server can lead to a Denial of Service DoS condition. Recommendations ...
Oracle Linux 9 : php (ELSA-2026-33449)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33449 advisory. - Fix XSS within status endpoint CVE-2026-6735 - Fix Null pointer dereference in phpmbcheckencoding via mberegsearchinit CVE-2026-7259 - Fix Stale...
