110386 matches found
CVE-2026-76212 phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL
phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...
CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export
phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...
MINI-PGQR-FPHP-79R4
Bulletin has no description...
WordPress Spectra theme <= 2.6.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Spectra versions = 2.6.1...
CVE-2026-73389
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73364
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-67364
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...
EUVD-2026-62397
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...
CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...
CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...
CVE-2026-67364
Balbooa Forms for Joomla (versions
CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73389
CVE-2026-73389 is an unauthenticated PHP Object Injection vulnerability in the Kalles Addons WordPress plugin, affecting versions 1.0.6 and earlier . The flaw allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability, reflected in a CVSS ...
CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
EUVD-2026-62390
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
EUVD-2026-62388
Unauthenticated Local File Inclusion in Resido = 1.5 versions...
CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
EUVD-2026-62384
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73364
WordPress Flexible Subscriptions plugin (versions ≤ 1.8.1) is vulnerable to PHP Object Injection, allowing unauthenticated remote attackers to execute arbitrary code and achieve full system compromise (CVSS 9.8 Critical). Patchstack reference: https://patchstack.com/database/wordpress/plugin/flex...