CVE-2026-105383: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transactionidS leads to sql injection. The attack can be executed remotely...

PT-2026-106040

Name of the Vulnerable Software and Affected Versions onetwothreeneth HospitalManagementSystem versions prior to 9ef91ed6007314b6473110ed699dff76d158f61d Description A remote SQL injection exists in the file php/controller.php. This occurs when the transaction idS argument is manipulated, allowin...

WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Denver Jackson in WordPress Theme Haaken versions = 1.5...

WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin VK Google Job Posting Manager versions = 1.3.1...

WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Spell Check versions = 12.1...

WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Event Planner versions = 1.5.7...

WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sunshine Photo Cart versions = 3.7.1...

WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Ultimate Exporter versions = 3.0...

WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Feed PRO for WooCommerce versions = 13.5.7...

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pay with Vipps for WooCommerce versions = 6.2.0...

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peter Tang in WordPress Plugin Advanced Post Manager versions = 4.5.5...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

EUVD-2026-91955

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-75028 WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.0.18 . The vulnerability exists within the (template scope) function , specifically related to the 'food_menu_style' Ele...

CVE-2026-85015

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-85015

The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to an authenticated arbitrary file write via path traversal. The flaw exists because the plugin fails to sanitize file paths within uploaded archives before extraction. This allows authenticated users wi...

[SECURITY] Fedora 45 Update: php-pecl-xmlrpc-1.0.0~rc3-20.fc45

This extension provides functions to write XML-RPC servers and clients. You can find more information about XML-RPC at http://www.xmlrpc.com/, and more documentation on this extension and its functions at https://www.php.net/xmlrpc. The extension is unbundled from php-src as of PHP 8.0.0, because...

[SECURITY] Fedora 45 Update: php-libvirt-0.5.8-7.fc45

PHP language bindings for Libvirt API. For more details see: http://www.libvirt.org/php/...

[SECURITY] Fedora 45 Update: php-8.5.11-2.fc45

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...