Lucene search
+L

94115 matches found

Cvelist
Cvelist
added 6 days ago39 views

CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

9.3CVSS0.00386EPSS
SaveExploits1References1
Debian CVE
Debian CVE
added 6 days ago13 views

CVE-2026-17543

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

9.3CVSS5.9AI score0.00386EPSS
SaveExploits1
Cvelist
Cvelist
added 6 days ago41 views

CVE-2026-14602 Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

0.00524EPSS
SaveExploits0References1
Cvelist
Cvelist
added 6 days ago42 views

CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

7.5CVSS0.00569EPSS
SaveExploits0References8
CVE
CVE
added 6 days ago16 views

CVE-2026-1360

BuddyPress for WordPress up to 14.5.0 is affected by a Deserialization of Untrusted Data flaw in bp_unserialize_profile_field(), which calls unserialize() without the allowed_classes parameter on user-controlled XProfile field data. This allows an authenticated attacker (subscriber level or highe...

7.5CVSS6.6AI score0.00569EPSS
SaveExploits0References8
Cvelist
Cvelist
added 6 days ago49 views

CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

9.8CVSS0.00578EPSS
SaveExploits0References2
CVE
CVE
added 6 days ago40 views

CVE-2026-16610

CVE-2026-16610 , for the Admin and Site Enhancements (ASE) Pro WordPress plugin, is documented as allowing unauthenticated remote code execution in all versions up to 8.9.0 via the recursive_html function. The root cause is a vulnerable frontend save handler that relies on a publicly emitted nonc...

9.8CVSS6.2AI score0.00578EPSS
SaveExploits0References2
EUVD
EUVD
added 6 days ago8 views

EUVD-2026-51328

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

6.2AI score0.00367EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 6 days ago14 views

PT-2026-66458

Name of the Vulnerable Software and Affected Versions PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Attacker-provided inputs to the bccomp function can lead to an out-of-bounds write, resulting in stack and heap corruption. An out-of-bounds write occurs when a...

9.3CVSS5.5AI score0.00428EPSS
SaveExploits0References7
Tenable Nessus
Tenable Nessus
added 6 days ago12 views

Linux Distros Unpatched Vulnerability : CVE-2026-7260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. befor...

8.1CVSS5.5AI score0.00168EPSS
SaveExploits0References3
Oracle linux
Oracle linux
added 6 days ago10 views

vim security update

9.1.083-9.0.1.el102.12 - Remove upstream references Orabug: 31197557 2:9.1.083-9.12 - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:9.1.083-9.11 - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion 2:9.1.083-9.10 -...

8.4CVSS6.4AI score0.00216EPSS
SaveExploits1
Positive Technologies
Positive Technologies
added 6 days ago9 views

PT-2026-66463

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Circular symbolic links in phar archives can cause unbounded recursion, which exhausts the C sta...

8.1CVSS5.4AI score0.00168EPSS
SaveExploits0References7
Tenable Nessus
Tenable Nessus
added 6 days ago16 views

PHP 8.3.x < 8.3.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.3.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

9.3CVSS6AI score0.00386EPSS
SaveExploits1References6
Tenable Nessus
Tenable Nessus
added 6 days ago9 views

Linux Distros Unpatched Vulnerability : CVE-2026-17543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before...

9.3CVSS5.8AI score0.00386EPSS
SaveExploits1References3
Tenable Nessus
Tenable Nessus
added 6 days ago9 views

Linux Distros Unpatched Vulnerability : CVE-2026-17544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5...

9.3CVSS5.6AI score0.00428EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 6 days ago9 views

RHEL 9 : vim (RHSA-2026:47982)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47982 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds...

8.4CVSS6.4AI score0.00216EPSS
SaveExploits1References12
Tenable Nessus
Tenable Nessus
added 6 days ago10 views

RockyLinux 9 : vim (RLSA-2026:47982)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47982 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrin...

8.4CVSS6.3AI score0.00216EPSS
SaveExploits1References11
Positive Technologies
Positive Technologies
added 6 days ago11 views

PT-2026-66457

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Improper escaping of backslashes in attacker-provided parameters allows for SQL injection, a...

9.3CVSS5.6AI score0.00386EPSS
SaveExploits1References7
Tenable Nessus
Tenable Nessus
added 6 days ago8 views

PHP 8.2.x < 8.2.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.2.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

9.3CVSS6AI score0.00386EPSS
SaveExploits1References6
Tenable Nessus
Tenable Nessus
added 6 days ago9 views

PHP 8.5.x < 8.5.9 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.5.9. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.9 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2...

9.3CVSS6AI score0.00428EPSS
SaveExploits1References8
Rows per page
Query Builder