PT-2026-82462

Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...

CVE-2026-78292: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

EUVD-2026-67262

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37068

The Veno File Manager Project 4.4.9 is vulnerable to an arbitrary file write flaw within the /vfm-admin/index.php?section=translations&action=update endpoint. This issue allows an authenticated user with super administrator privileges to overwrite any PHP file within the application by sending a ...

PT-2026-82426

Name of the Vulnerable Software and Affected Versions Joomla Event Manager versions prior to 5.0.1 Description An issue in the administrator source model allows the upload of dangerous file types, including PHP files, which can lead to privileged remote code execution. Recommendations Update Joom...

PT-2026-82451

Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.6 Description An issue exists that allows for PHP Object Injection, a technique where an attacker leverages the deserialization of untrusted data to instantiate arbitrary objects and execute...

CVE-2026-78286: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...

CVE-2026-81525: Improper Neutralization of Special Elements in Data Query Logic

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

PT-2026-82739

Name of the Vulnerable Software and Affected Versions MongoDB client library for PHP affected versions not specified Description The MongoDB client library for PHP fails to properly sanitize special elements within application-supplied namespace identifiers used to construct target namespaces for...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

PT-2026-82458

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78276: Deserialization of Untrusted Data

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78257: Deserialization of Untrusted Data

Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-37069: Exposure of Sensitive Information to an Unauthorized Actor

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

PT-2026-82671

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-54718: Improper Neutralization of Special Elements Used in a Template Engine

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

PT-2026-82654

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The Tutor LMS WordPress plugin contains a template injection issue caused by insufficient validation of request data. This allows unauthenticated users to overwrite internal variables during templa...

CVE-2026-77991: Unrestricted Upload of File with Dangerous Type

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

PT-2026-82538

Name of the Vulnerable Software and Affected Versions Volmarg Personal Management System affected versions not specified Description Authenticated attackers can read arbitrary files by providing absolute filesystem paths to the 'GET /public/get-file/path' endpoint. This occurs because the path...