Lucene search
+L

94102 matches found

NVD
NVD
added 2 days ago10 views

CVE-2026-61523

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

8.6CVSS0.00644EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2 days ago6 views

CVE-2026-61524 WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

8.6CVSS6.3AI score0.00555EPSS
SaveExploits0References3
EUVD
EUVD
added 2 days ago7 views

EUVD-2026-52394

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

8.6CVSS6.3AI score0.00555EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2 days ago43 views

CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

8.6CVSS0.00644EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2 days ago7 views

CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

8.6CVSS6.5AI score0.00644EPSS
SaveExploits0References3
CVE
CVE
added 2 days ago30 views

CVE-2026-39932

CVE-2026-39932 affects OpenEMR 8.2.0, enabling remote code execution through the document category tree component. The vulnerability arises from an unsanitized eval() in CategoryTree (library/classes/Tree.class.php) that executes PHP payloads injected into the categories table. An authenticated a...

9.4CVSS6.9AI score0.00773EPSS
SaveExploits0References2
EUVD
EUVD
added 2 days ago7 views

EUVD-2026-52345

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

9.4CVSS6.9AI score0.00773EPSS
SaveExploits0References2
NVD
NVD
added 2 days ago13 views

CVE-2026-16250

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

9.8CVSS0.00222EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago7 views

EUVD-2026-52180

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...

4.1CVSS6.3AI score0.0023EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2 days ago49 views

CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

0.00222EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2 days ago45 views

CVE-2025-15672 Chama < 1.0.13 - Unauthenticated PHP Object Injection

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other...

0.00222EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago6 views

EUVD-2026-52168

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

6.6AI score0.00276EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2 days ago95 views

MetInfo CMS <= 8.1 - Remote Code Execution

MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests. id: CVE-2026-29014 info: name: MetInfo CMS = 8....

9.8CVSS8.7AI score0.41576EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2 days ago78 views

PHP CGI v5.3.12/5.4.2 Remote Code Execution

sapi/cgi/cgimain.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string,...

9.8CVSS8.6AI score0.99998EPSS
SaveExploits44References5
Nuclei
Nuclei
added 2 days ago142 views

FOG Project < 1.5.10.34 - Remote Command Execution

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. id: CVE-2024-39914 info: name: FOG Project 1.5.10.34 - Remote...

9.8CVSS5.5AI score0.23414EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2 days ago182 views

Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

9.8CVSS7.7AI score0.35228EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2 days ago53 views

Qualitor <= 8.20 - Remote Code Execution

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter. id: CVE-2023-47253 info: name: Qualitor = 8.20 - Remote Code Execution author: s4e-io severity: critical description: |...

9.8CVSS8.3AI score0.14422EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2 days ago1569 views

Roundcube Webmail - Remote Code Execution

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. id: CVE-2025-49113 info: name: Roundcube Webmail - Remote...

9.9CVSS8.6AI score0.97694EPSS
SaveExploits29References8
Nuclei
Nuclei
added 2 days ago24 views

ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)

ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzzfile.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter, exploit requires attacker to send malicious URL and...

9.8CVSS8.8AI score0.06589EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2 days ago35 views

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

10CVSS8.2AI score0.2872EPSS
SaveExploits3References4
Rows per page
Query Builder