CVE-2026-15148

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

CVE-2025-15148

creationtimestamp| type| source ---|---|--- 2025-12-28 21:04:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mb37w6hykp2r...

CVE-2019-15148

GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMFmp4reader.c...

CVE-2020-15148

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

CVE-2017-15148

...

CVE-2017-15148

CVE-2017-15148 is rejected/not used and does not represent an active vulnerability entry.

CVE-2020-15148

CVE-2020-15148 – Yii 2 (

CVE-2020-15148 Unsafe deserialization in Yii 2

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

CVE-2019-15148

GoPro GPMF-parser 1.2.2 contains an out-of-bounds write in OpenMP4Source (demo/GPMF_mp4reader.c). The provided documents do not specify exploit details, affected versions beyond 1.2.2, or remediation steps; no in-the-wild exploit information is given. Monitor for official fixes or advisories in u...

CVE-2018-15148

SQL injection vulnerability in interface/patientfile/encounter/searchcode.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter...

CVE-2018-15148

SQL injection vulnerability in interface/patientfile/encounter/searchcode.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter...

CVE-2018-15148

OpenEMR prior to 5.0.1.4 is vulnerable in interface/patient_file/encounter/search_code.php where the text parameter can be leveraged to perform SQL injection, allowing a remote authenticated attacker to execute arbitrary SQL commands. Affected versions: OpenEMR before 5.0.1.4. Root cause: imprope...