696 matches found
PT-2026-79058
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom field project attribute. The dialog path resolves the project custom field by its raw identifier without...
CVE-2026-19613
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...
EUVD-2026-59913
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...
CVE-2026-19613
The ECS WordPress plugin (Ele Custom Skin for Elementor) versions prior to 4.3.10 is vulnerable to arbitrary post meta disclosure. The root cause is a failure to perform ownership or post-status checks when a dynamic repeater data source retrieves custom field values using a user-supplied post id...
CVE-2026-19613
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...
CVE-2026-19613: Exposure of Sensitive Information to an Unauthorized Actor
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...
PT-2026-73121
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...
CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field — Updated!
Security Advisory: Camaleon CMS - Authenticated RCE via selecteval Custom Field Assigned CVE ID: CVE-2026-66748 Product: Camaleon CMS https://github.com/owen2345/camaleon-cms Affected versions: 2.1.1 – 2.9.1 introduced commit 415cbda6 2015-10-16; fixed commit 15882366 2026-03-29 / v2.9.2 Severity...
CVE-2026-66748 Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...
CVE-2026-66748 Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...
EUVD-2026-49690
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
CVE-2026-55464 Snipe-IT: Stored XSS via Markdown custom field
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScrip...
CVE-2026-57687
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
EUVD-2026-41296
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
CVE-2026-57687
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
CVE-2026-57687 WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
CVE-2026-57687 WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
CVE-2026-57687
CVE-2026-57687 concerns a SQL Injection vulnerability in the WordPress plugin Custom Field Template (versions