109823 matches found
CVE-2026-103592: Use of Less Trusted Source
simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...
PT-2026-103507
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...
PT-2026-103504
Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...
PT-2026-103163
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...
PT-2026-103171
Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...
PT-2026-103161
Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...
PT-2026-103329
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results ...
PT-2026-103188
Custom role PHP Object Injection in WP ERP = 1.17.9 versions...
PT-2026-103189
Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...
PT-2026-103185
Subscriber PHP Object Injection in Conversational Forms for ChatBot = 1.5.0 versions...
PT-2026-103170
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...
PT-2026-103216
Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...
PT-2026-103159
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...
PT-2026-103022
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
PT-2026-103244
Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...
PT-2026-103242
Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...
PT-2026-103488
Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...
PT-2026-103499
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...