110675 matches found
EUVD-2026-61091
An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...
CVE-2026-66620: Deserialization of Untrusted Data
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-73366: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73341: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-75080: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /editsubject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit...
CVE-2026-73380: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-52608: Improper Access Control
An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...
CVE-2026-75827: Improper Control of Generation of Code
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...
PT-2026-76897
A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check availability.php. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has...
PT-2026-77171
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...
CVE-2026-52608
An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...
CVE-2026-45117: Improper Control of Generation of Code
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...
PT-2026-77086
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-52607
The reportico-web software (version
CVE-2026-32470: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
EUVD-2026-61097
A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...
PT-2026-77103
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
PT-2026-77102
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...