2188 matches found
CVE-2026-73533: Embedded Malicious Code
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...
WordPress Ninja Tables Pro plugin 5.2.11 - Backdoor vulnerability
Backdoor vulnerability discovered by ? in WordPress Plugin Ninja Tables Pro versions 5.2.11...
The vulnerability of the NF_FU_AJAX_Controllers_Uploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin allows a attacker to execute arbitrary code.
The vulnerability of the NFFUAJAXControllersUploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin is related to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...
CVE-2026-19328
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...
CVE-2026-19328 aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...
CVE-2026-19328
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...
EUVD-2026-54859
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...
CVE-2026-19328 aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...
CVE-2026-19328
Summary (CVE-2026-19328): The vulnerability affects aktsmm skill-ninja-mcp-server version 0.1.0, specifically the functions getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill in src/installer.ts. The issue is a local path traversal caused by manipulation of the workspacePath arg...
CVE-2026-19328: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...
PT-2026-69251
Name of the Vulnerable Software and Affected Versions aktsmm skill-ninja-mcp-server version 0.1.0 Description Local manipulation of the workspacePath argument in the getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill functions within the src/installer.ts file allows for path...
EUVD-2026-54201
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
CVE-2026-15256
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
CVE-2026-15256
The CVE affects the Ninja Forms WordPress plugin (pre-3.14.10). The issue arises because user-supplied query-string input used to pre-populate a field’s default value is not filtered and can be processed as a shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes registered...
CVE-2026-61964
Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...
CVE-2026-61964
The CVE concerns WordPress Ninja Tables plugin