EUVD-2026-52345

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39932

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

Duplicate Advisory: Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7pgq-cr25-xvc8. This link is maintained to preserve external references. Original Description Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprin...

CVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

Joomla Aimy Captcha-Less Form Guard RCE (CVE-2026-65883)

Unauthenticated RCE in Aimy Captcha-Less Form Guard 18.0–20.0: recover the XOR keystream from the clfgd field, inject a FormattedtextLogger gadget, write a PHP webshell, then execute the configured payload. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-65883 — Aimy Captcha-Less Form Guard...

Security update for vim

This update for vim fixes the following issues: Security issues fixed: CVE-2026-59856: arbitrary code execution via PHP omni-completion bsc1271194. CVE-2026-59857: out-of-bounds write in SAL soundfolding bsc1271195. CVE-2026-59858: arbitrary code execution via C omni-completion bsc1271193. Non...

CVE-2026-16250

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

CVE-2026-12872

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

WordPress BuddyPress plugin <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection vulnerability

Authenticated Subscriber+ PHP Object Injection vulnerability discovered by Vincent Theriault-Laine in WordPress Plugin BuddyPress versions = 14.5.0...

sqli-xss-vulnerable-lab

SQL Injection ve Cross-Site Scripting XSS Laboratuvarı Za...

CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

EUVD-2026-52180

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...

EUVD-2026-52168

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

CVE-2025-15672 Chama < 1.0.13 - Unauthenticated PHP Object Injection

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other...

PHP CGI v5.3.12/5.4.2 Remote Code Execution

sapi/cgi/cgimain.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string,...

PT-2026-67399

Name of the Vulnerable Software and Affected Versions Telenia Software TVox versions prior to 26.5.3 Telenia Software TVox versions prior to 24.9.21 Description An authentication bypass exists in the set env.php file. The redirectToLoginAdminIRequestHaveAccessToken function determines the current...

PT-2026-67400

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec call...

CVE-2026-12872: Unrestricted Upload of File with Dangerous Type

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

PT-2026-67517

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.7.5 Description An authenticated attacker can execute arbitrary SQL commands through a SQL injection flaw in the CommentBat feature. The issue occurs via the id parameter. Recommendations At the moment, there is no...

PT-2026-67491

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is...