CVE-2026-15039

The Gift Cards For WooCommerce Pro WordPress plugin (versions

CVE-2026-15039

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

WordPress AI ANN PHP Object Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress AI ANN suffers from a PHP object injection vulnerability. This vulnerability stems from improper handling of user input by the deserialization module, allowing attackers to inject...

CVE-2026-47227: Authorization Bypass Through User-Controlled Key

Admidio is an open-source user management solution. modules/categories.php checks that the supplied type parameter ANN, EVT, ROL, USF, … corresponds to a module the actor administers. The follow-up "is this specific category editable by me" check at lines 56-61 is dead code because it compares...

CVE-2026-67285: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system...

CVE-2026-15039: Unrestricted Upload of File with Dangerous Type

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-18391: Unrestricted Upload of File with Dangerous Type

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

PT-2026-71370

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

WordPress Ajax Search Lite PHP Object Injection Vulnerability

WordPress Ajax Search Lite is a free WordPress plugin developed by wpdreams. It provides a real-time search experience where results are displayed immediately upon input. This plugin can replace the default search function and supports customization of content types and fields. However, WordPress...

Debian dla-4732 : libapache2-mod-php8.2 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4732 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4732-1 [email protected]...

WordPress 69: PHP Object Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress 69 Clothing has a PHP object injection vulnerability, which stems from the lack of security checks on deserialized data by the program. Attackers can exploit this vulnerability to...

Linux Distros Unpatched Vulnerability : CVE-2026-62992

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line,...

Linux Distros Unpatched Vulnerability : CVE-2026-72556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the...

PT-2026-71025

Name of the Vulnerable Software and Affected Versions WooCommerce Subscriptions versions prior to 9.1.0 Description Insufficient validation of user input before unserialization occurs on stores with High-Performance Order Storage enabled. This leads to a PHP Object Injection, which unauthenticate...

PT-2026-71007

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

WordPress: A Williams PHP Object Injection Vulnerability

WordPress A Williams is a commercial WordPress theme designed for secretaries, personal assistants, administrative staff, and consulting companies. WordPress A Williams has a PHP object injection vulnerability, which stems from improper deserialization of untrusted data, allowing for PHP object...

Debian dla-4733 : libapache2-mod-php7.4 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4733 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4733-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-62996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream:...

CVE-2026-55676

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...