PT-2026-68103

Name of the Vulnerable Software and Affected Versions Miantang/IoT-PHP affected versions not specified Description The index.php file implements a POST '/userlogin' endpoint that is susceptible to SQL injection. The application reads the password from the pwd variable without sanitization and...

CVE-2026-71248: Improper Neutralization of Special Elements used in an SQL Command

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=...

CVE-2026-71232: Improper Control of Generation of Code

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...

CVE-2026-14553: Unrestricted Upload of File with Dangerous Type

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user Subscriber or higher to upload arbitrary PHP files and achieve remote code execution...

CVE-2026-71237: Improper Neutralization of Special Elements used in an SQL Command

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...

PT-2026-68166

Name of the Vulnerable Software and Affected Versions Cotonti CMS affected versions not specified Description The Comments plugin in Cotonti CMS fails to restrict classes during the deserialization of user-supplied data, leading to a PHP Object Injection. This occurs when the unserialize function...

openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21520-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21520-1 advisory. - CVE-2026-45793: Github Actions issued GITHUBTOKEN disclosure in GitHub Actions logs bsc1271504. - CVE-2026-59946: path traversal in package bi...

PT-2026-68554

Name of the Vulnerable Software and Affected Versions WPBruiser no- Captcha anti-Spam versions prior to 3.1.44 Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to manipulate the resulting object. Thi...

Oracle Linux 10 : php8.4 (ELSA-2026-49914)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49914 advisory. 8.4.23-1 - rebase to 8.4.23 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

CVE-2026-70553

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious...

CVE-2026-70554 MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70554

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

EUVD-2026-52894

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70554 MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70553 MaxSite CMS Unauthenticated RCE via Install Endpoint

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious...

CVE-2026-70553

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious...

K000162775: PHP Phar vulnerability CVE-2026-7260

Security Advisory Description Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-7260 Impac...

Updated php packages fix security vulnerabilities

This update brings the latest version of php 8.2 and fixes some security vulnerabilities...

MGASA-2026-0322 Updated php packages fix security vulnerabilities

This update brings the latest version of php 8.2 and fixes some security vulnerabilities...

CVE-2026-18788 Trippo ResponsiveFilemanager dialog.php unrestricted upload

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...