127 matches found
Joomla! Extension 'JCE' < 2.9.99.5 Remote Code Execution
The version of the JCE Joomla Content Editor extension for the Joomla! application running on the remote host is prior to 2.9.99.5. It is, therefore, affected by an improper access control vulnerability. The extension allows the creation of new editor profiles for unauthenticated users, ultimatel...
The vulnerability of the Joomla Content Editor (JCE) extension of the Joomla content management system allows a hacker to execute arbitrary code.
The vulnerability of the Joomla Content Editor JCE component of the Joomla content management system is related to access control errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-48907link is external Widget Factory Joomla Content Editor Improper Access Control Vulnerability This type of vulnerability is a frequent attack vector for...
Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users...
Exploit for CVE-2026-48907
๐จ CVE-2026-48907 - JCE Joomla Content Editor Unauthenticated...
JoomlaSniper
JoomlaSniper CVE-2026-48907 โ Joomla JCE Editor Unauthen...
17fe-ui23 (>=0.0.0, <=0.0.24), @2kog/pkg-editor (>=0.0.1, <=0.1.3) +746 more potentially affected by CVE-2026-47761 via tinymce (>=6.0.0, <=7.5.1)
tinymce NPM version =6.0.0, =0.0.0, =0.0.1, =12.1.0, =4.1.0, =1.0.0-beta.1, =4.1.2-rc, =1.0.0, =0.1.0, =0.1.23 and more Source cves: CVE-2026-47761 Source advisory: OSV:GHSA-VG35-5WQ7-3X7W...
CVE-2025-15369
The Xpro Addons โ 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getcontenteditor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create...
CVE-2026-48907 Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution...
CVE-2026-48907 Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution...
bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47759 via tinymce (>=8.0.2, <=8.2.2)
tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47759 Source advisory: SNYK:JS-TINYMCE-17056166...
@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +6 more potentially affected by CVE-2026-47761 via tinymce (>=7.0.1, <=7.5.1)
tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.0.0, =4.0.0, =0.2.10, =0.2.19 Source cves: CVE-2026-47761 Source advisory: SNYK:JS-TINYMCE-17056137...
@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +6 more potentially affected by CVE-2026-47762 via tinymce (>=7.0.1, <=7.5.1)
tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.0.0, =4.0.0, =0.2.10, =0.2.19 Source cves: CVE-2026-47762 Source advisory: SNYK:JS-TINYMCE-17056141...
CVE-2025-15369
The Xpro Addons โ 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getcontenteditor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create...
CVE-2025-15369 Xpro Addons โ 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation
The Xpro Addons โ 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getcontenteditor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create...
CVE-2025-15369
The Xpro Addons โ 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getcontenteditor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create...
CVE-2025-15369
CVE-2025-15369 affects the WordPress plugin Xpro Addons โ 140+ Widgets for Elementor. All versions up to and including 1.5.0 are vulnerable due to a missing capability check in the get_content_editor function, enabling unauthenticated attackers to modify data and create published Xpro templates. ...
PT-2026-42086
Name of the Vulnerable Software and Affected Versions Xpro Addons โ 140+ Widgets for Elementor versions prior to 1.5.1 Description The plugin is susceptible to unauthorized data modification because the get content editor function lacks a proper capability check. This flaw allows unauthenticated...
WordPress plugin Xpro Addons โ 140+ Widgets for Elementor ๅฎๅ จๆผๆด
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...
EUVD-2026-24135
In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code...