EUVD-2026-86509

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...

CVE-2026-97730

A Local File Inclusion (LFI) vulnerability exists in Netgate pfSense Plus before version 26.07 and pfSense CE before version 2.9.0. The flaw resides in the Dashboard (index.php) widget sequence data handling. An authenticated attacker with permissions to modify Dashboard settings and write files ...

phpcms-2008-CVE-2018-19127

phpcms-2008-CVE-2018-19127 Recientemente encontramos una vulnerabilidad en /type.php del código fuente de phpcms 2008. Cuando los atacantes envían solicitudes manipuladas como "/type.php?template=tag;@unlinkFILE;assert$POST1;//../rss", el contenido malicioso en este caso "@unlinkFILE;assert$POST1...

CVE-2026-12227

The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...

Citrix SD-WAN Center - Local File Inclusion

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...

CVE-2021-44967

CVE-2021-44967 - RCE autenticado privilegiado La ejecución remota de comandos autenticada privilegiada en LimeSurvey Versión 5.2.4 mediante la carga e instalación de complementos permite a un usuario remoto cargar un archivo de código PHP arbitrario. Uso python3 exploit.py --url --user --password...

EUVD-2026-85024

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

CVE-2026-88419

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

EUVD-2026-84851

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

CVE-2026-88419

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

Python-exploit-CVE-2020-25213

描述 WordPress的File Manager wp-file-manager 插件6.9之前的版本允许远程攻击者上传并执行任意PHP代码，因为它将一个不安全的示例elFinder连接器文件重命名为.php扩展名。例如，这允许攻击者运行elFinder的upload（或mkfile和put）命令，将PHP代码写入 wp-content/plugins/wp-file-manager/lib/files/ 目录。该漏洞于2020年8月和9月在野外被利用。 演示 root@kitploit: python3 exploit.py url command python3 exploit.p...

CVE-2026-88856

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions updateOSGallery, reached via task=updateosgallery, read a JSON request body and called the value of a method field as a live PHP function, passi...

Vvveb-CMS-CVE-2025-8518

Vvveb-CMS-CVE-2025-8518 Este repositorio contiene una Prueba de Concepto PoC que demuestra una vulnerabilidad crítica en givanz Vvveb 1.0.5. La vulnerabilidad permite a un usuario autenticado con privilegios de edición de plantillas escribir código PHP arbitrario en archivos del servidor, lo que...

CVE-2026-92593: Improper Control of Generation of Code

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

CVE-2026-14560: Improper Control of Generation of Code

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2026-84063: Unrestricted Upload of File with Dangerous Type

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

CVE-2026-82925: Deserialization of Untrusted Data

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

PT-2026-84725

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-19092: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

CVE-2026-34741: Missing Authentication for Critical Function

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...