110216 matches found
CVE-2026-78478: Improper Control of Filename for Include/Require Statement in PHP Program
The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...
CVE-2026-14280: Improper Control of Filename for Include/Require Statement in PHP Program
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
CVE-2026-75574: Improper Neutralization of Special Elements Used in a Template Engine
The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...
PT-2026-81164
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em options save function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
PT-2026-81250
Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...
PT-2026-81224
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The indexer of the extension uses the PHP unserialize function to process field values returned by content object rendering when transferring multi-value data fo...
CVE-2026-77138: Deserialization of Untrusted Data
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...
CVE-2026-56706: Use of Insufficiently Random Values
Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...
Linux Distros Unpatched Vulnerability : CVE-2026-56703
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions...
Linux Distros Unpatched Vulnerability : CVE-2026-48820
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0...
CVE-2026-56095: Deserialization of Untrusted Data
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...
PT-2026-81217
Name of the Vulnerable Software and Affected Versions Verdure Core versions prior to 1.3 Description The Verdure Core plugin for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of PH...
CVE-2026-56702: Unrestricted Upload of File with Dangerous Type
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...
PT-2026-81129
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...
CVE-2026-57863: Improper Limitation of a Pathname to a Restricted Directory
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
PT-2026-81219
The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...
CVE-2026-77998: Authorization Bypass Through User-Controlled Key
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO 11.0.2, SAML SP Single Sign On – Login with ADFS 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps 6.4 - This is due to the mosamlvalidatesignature function...
Linux Distros Unpatched Vulnerability : CVE-2026-77634
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail heade...
CRLF Injection
Overview cakephp/cakephp is a rapid development framework for PHP which uses commonly known design patterns like Associative Data Mapping, Front Controller, and MVC. Affected versions of this package are vulnerable to CRLF Injection via the setHeaders or addHeaders functions. An attacker can inje...
