111389 matches found
EUVD-2026-91043
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...
CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...
CVE-2026-53953
In GetSimple CMS CE version 3.3.22 , the password reset endpoint is accessible without authentication. When a reset request is submitted for an existing user, the application generates a temporary password using PHP rand() seeded with microtime() . Because this seed is time-based and has a limite...
CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...
CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...
PHP-8.1.0-dev-Backdoor
PHP 8.1.0-dev User-Agentt Backdoor Remote Code Execution RCE Severity: Critical CVSS Equivalent: 10.0 Vulnerability Type: Supply Chain Backdoor / Remote Code Execution RCE Affected Software: PHP 8.1.0-dev Development Build Only Attack Vector: Remote Unauthenticated Authentication Required: No Use...
CVE-2026-97284
Contributor PHP Object Injection in Icegram = 3.1.31 versions...
CVE-2026-94390
Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...
CVE-2026-97284 WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Icegram = 3.1.31 versions...
CVE-2026-97284 WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Icegram = 3.1.31 versions...
EUVD-2026-90840
Contributor PHP Object Injection in Icegram = 3.1.31 versions...
CVE-2026-97284
The WordPress Icegram plugin (versions
CVE-2026-94390 WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...
CVE-2026-94390 WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...
CVE-2026-94390
The Hide Shipping Method For WooCommerce plugin for WordPress versions
EUVD-2026-90854
Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...
Exploit for CVE-2026-102425
🖥️ BAForms-RCE — CVE-2026-102425 GUI Dark-neon GUI scanner/...
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide Shipping Method For WooCommerce versions = 1.5.4...
WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Icegram versions = 3.1.31...
BIT-PHP-MIN-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...