Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

EUVD-2026-62542

Grav: Authenticated ReDoS via regexreplace in Twig Sandbox...

CLEANSTART-2026-PP06493 Security fixes in vault 2.0.4-r3

Package vault version 2.0.4-r3 fixes 1 vulnerabilities: CVE-2026-33818...

EUVD-2026-65162

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

EUVD-2026-65163

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

CVE-2026-32556

CVE-2026-32556 affects the WordPress Boost plugin versions 2.0.4 and earlier , introducing an unauthenticated Cross-Site Scripting (XSS) vulnerability. A remote attacker can inject malicious script content that executes in the context of a victim's browser, requiring user interaction but no prior...

CVE-2026-32555

CVE-2026-32555 is an unauthenticated SQL injection vulnerability in the WordPress Boost plugin , affecting versions 2.0.4 and earlier . The flaw allows a remote, unauthenticated attacker to exploit the injection over the network with low complexity and no user interaction , resulting in high conf...

WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

PT-2026-81047

Name of the Vulnerable Software and Affected Versions Boost versions 2.0.4 and earlier Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database...

CVE-2026-62672

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

CVE-2026-62673

Grav (file-based web platform) prior to 2.0.4 contains a case-sensitivity flaw in its default .htaccess and webserver-configs/htaccess.txt. Three Apache RewriteRule directives that block access to sensitive file types (.yaml, .php, .json, etc.) under user/ and system/vendor/ omit the [NC] flag, m...

CVE-2026-62673 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

CVE-2026-62672 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

PT-2026-78488

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description Grav allows the regex replace filter and function in system/config/security.yaml. The GravExtension::regexReplace function passes a pattern controlled by the editor directly to preg replace. When...

EUVD-2026-60924

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

CVE-2026-66639 WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

CVE-2026-65517

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-65517 WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy PayPal Buy Now Button versions = 2.0.4...