110403 matches found
OESA-2026-3475 php security update
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
WordPress All-in-One WP Migration and Backup plugin < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability
Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability discovered by Mohamed Bassia in WordPress Plugin All-in-One WP Migration versions 7.108...
CVE-2026-14946
A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...
CVE-2026-14946
Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to remote code execution due to improper file type validation . A high-privileged remote attacker can upload a .php file and then request it directly from /uploads/.php, leading to arbitrary code execution and potential full system co...
EUVD-2026-63217
A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...
CVE-2026-14946 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.
A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...
WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability
Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...
WordPress Newsletters plugin < 4.16 - Unauthenticated PHP Object Injection via Date Form Field vulnerability
Unauthenticated PHP Object Injection via Date Form Field vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Newsletters versions 4.16...
WordPress Ajax Search Lite plugin < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability
Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability discovered by Jakub Herman in WordPress Plugin Ajax Search Lite versions 4.14.5...
WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flatastic versions = 2.0...
CVE-2026-75963
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...
CVE-2026-13405
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
EUVD-2026-63201
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
CVE-2026-13405
The Royal Addons for Elementor WordPress plugin (versions before 1.7.1066 ) is vulnerable to Remote Code Execution (RCE) . The flaw exists because the plugin fails to properly sanitise custom widget markup before writing it to a file that is subsequently executed. This allows authenticated users ...
CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...
EUVD-2026-63199
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...
CVE-2026-75963
The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...
