CVE-2026-39353 InvoicePlane: Remote Code Execution via Writable Templates Directory

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious...

EUVD-2026-87125

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's UserController compares the session usertype value with the required role by using PHP's loose inequality operator. Under a non-standard session backend that returns...

CVE-2026-85292

In InvoicePlane versions prior to 1.7.2 , a loose type comparison in the User_Controller allows for potential authentication or authorization bypass . The application uses PHP's loose inequality operator to compare the session user_type value against the required role. In specific configurations ...

WordPress wpForo Forum plugin < 3.1.6 - Subscriber+ PHP Object Injection vulnerability

Subscriber+ PHP Object Injection vulnerability discovered by Sai Praneeth Koti in WordPress Plugin wpForo Forum versions 3.1.6...

CVE-2026-19804

The s2Member plugin for WordPress (versions up to and including 260814 ) is vulnerable to Remote Code Execution (RCE) . The root cause is insufficient sanitization of the first_name parameter using esc_refs(), which fails to strip PHP tags before they are substituted into an eval'd Signup Trackin...

CVE-2026-13456 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-86595

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-92799

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

CVE-2026-92799

The Bookly plugin for WordPress is vulnerable to an Authorization Bypass in all versions up to and including 28.2 . The root cause is PHP Type Juggling within the postValidateCustomer() function, which uses a loose inequality operator (!=) to compare a session-stored one-time verification code ag...

CVE-2026-92799 Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

CVE-2026-92799 Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

EUVD-2026-86543

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

CVE-2026-62993

A flaw was found in Smarty, a PHP template engine. The fetch function, when a security policy was active, only validated the initial remote URL against a trusteduri allowlist. However, PHP's filegetcontents function, used for resources including HTTPS URLs, followed HTTP redirects by default. Thi...

EUVD-2026-86509

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...

CVE-2026-97730

A Local File Inclusion (LFI) vulnerability exists in Netgate pfSense Plus before version 26.07 and pfSense CE before version 2.9.0. The flaw resides in the Dashboard (index.php) widget sequence data handling. An authenticated attacker with permissions to modify Dashboard settings and write files ...

CVE-2026-97730

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...

CVE-2026-97730

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...

PT-2026-98876

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2-rc-1 Description InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file plac...

CVE-2026-97730: Path Traversal: '../filedir'

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...

CVE-2026-17545: Improper Handling of Windows Device Names

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...