CVE-2026-93957: Incorrect Comparison

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The explo...

CVE-2026-93956

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

CVE-2026-93956 olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

CVE-2026-93956

CVE-2026-93956 is a cross-site scripting (XSS) vulnerability in the SearchEngine::buildHighlights function of src/SearchEngine.php in the PHP-FTS library (olivier-ls/php-fts) versions up to 1.1.2 . Manipulating the Query argument allows an attacker to inject malicious scripts, which execute in th...

CVE-2026-93956 olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

CVE-2026-93956 olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

requestcraft

requestcraft GET and POST, taken apart down to the socket —...

CVE-2026-76579 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-92807: Improper Control of Generation of Code

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

PT-2026-95803

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache versions prior to 8.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link...

PT-2026-95755

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51 Description Unauthenticated users can upload arbitrary files because the plugin fails to validate file types or extensions in one of its form fields. Uploaded files are stored in a...

CVE-2026-84750: Unrestricted Upload of File with Dangerous Type

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

PT-2026-95752

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.3 Description Insufficient restriction of PHP functions used as custom field-validation callbacks allows users with form management privileges to trigger the...

PT-2026-95871

Name of the Vulnerable Software and Affected Versions olivier-ls PHP-FTS versions prior to 1.1.3 Description A flaw in the Search Engine component allows remote attackers to perform cross-site scripting XSS by manipulating the Query argument. The issue resides within the...

CVE-2026-93956: Improper Neutralization of Input During Web Page Generation

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2026-93872

Cotonti 1.0.0 is affected by a PHP object injection vulnerability in the comments plugin EditAction . The base64-decoded cb parameter is passed directly to unserialize() without an allowed_classes restriction, allowing registered users with comment write permissions to instantiate arbitrary PHP o...

Exploit for CVE-2026-82226

abraxaslabs.tech · github.com/abraxas ·&...

Exploit for CVE-2026-84753

abraxaslabs.tech · github.com/abraxas ·&...

EUVD-2026-82944

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...