110347 matches found
WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability
Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...
Exploit for CVE-2026-38526
🏴☠️ HTB Labs - Nexus English 🇺🇸 | Español 🇪🇸 English...
CVE-2026-77991
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
All-Line Equipment Company Fuel-Boss
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...
CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
CVE-2026-77991
Joomla Event Manager (a Joomla extension from joomlaeventmanager.net) versions prior to 5.0.1 are vulnerable to privileged remote code execution due to a flaw in the administrator source model , which allows writing dangerous file types including PHP. An authenticated attacker with high privilege...
EUVD-2026-66866
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...
e-SIC Livre 0.2.2 Resource Consumption
e-SIC Livre versions 0.2.2 and below suffer from a resource consumption vulnerability in the CAPTCHA generation component. CVE-2026-50787 — Uncontrolled Resource Consumption in e-SIC Livre Summary A resource consumption vulnerability exists in the CAPTCHA generation component of e-SIC Livre...
PT-2026-82465
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
PT-2026-84464
Name of the Vulnerable Software and Affected Versions Composer versions 1.0 through 2.2.29 Composer versions 2.10.0 through 2.10.2 Description Composer, a dependency manager for PHP, fails to validate the source.url when source.type is set to perforce. A malicious package from a custom repository...
CVE-2026-19092: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
PT-2026-82538
Name of the Vulnerable Software and Affected Versions Volmarg Personal Management System affected versions not specified Description Authenticated attackers can read arbitrary files by providing absolute filesystem paths to the 'GET /public/get-file/path' endpoint. This occurs because the path...
PT-2026-82462
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78292: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
EUVD-2026-67262
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...
CVE-2026-37068
The Veno File Manager Project 4.4.9 is vulnerable to an arbitrary file write flaw within the /vfm-admin/index.php?section=translations&action=update endpoint. This issue allows an authenticated user with super administrator privileges to overwrite any PHP file within the application by sending a ...
PT-2026-82426
Name of the Vulnerable Software and Affected Versions Joomla Event Manager versions prior to 5.0.1 Description An issue in the administrator source model allows the upload of dangerous file types, including PHP files, which can lead to privileged remote code execution. Recommendations Update Joom...
PT-2026-82451
Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.6 Description An issue exists that allows for PHP Object Injection, a technique where an attacker leverages the deserialization of untrusted data to instantiate arbitrary objects and execute...