CVE-2026-5957: Improper Limitation of a Pathname to a Restricted Directory

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 1.6.5. This is due to a flawed path traversal validation in the createtemplate method of the CheckForm class, where realpath is called on the allowed base directory...

EUVD-2023-51635

Malicious code in bioql PyPI...

CVE-2024-4577 Argument Injection in PHP-CGI

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

CVE-2023-47524

Unauth. Reflected Cross-Site Scripting XSS vulnerability requires PHP 8.x in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.9 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability requires PHP 8.x in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.9 versions...

CVE-2023-47524 WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability requires PHP 8.x in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.9 versions...

CVE-2023-47524 WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability requires PHP 8.x in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.9 versions...

CVE-2023-47524

CVE-2023-47524 affects CodeBard's Patron Button and Widgets for Patreon plugin for WordPress (

CVE-2023-47524: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability requires PHP 8.x in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.9 versions...

PHP 8.x < 8.0.11 Path Traversal

According to its self-reported version number, the version of PHP installed on the remote host is 7.3.x prior to 7.3.31, 7.4.x prior to 7.4.24, or 8.x prior to 8.0.11. It is, therefore, affected by a path traversal via ZipArchive::extractTo. Note that the scanner has not tested for these issues b...

PHP 8.x < 8.0.5 Header Injection Vulnerability

According to its self-reported version number, the version of PHP installed on the remote host is 7.3.x prior to 7.3.28, 7.4.x prior to 7.4.18, or 8.x prior to 8.0.5. It is, therefore, affected by a header injection via imapmailcompose. Note that the scanner has not tested for these issues but ha...

PHP 8.x < 8.0.2 Null Dereference Vulnerability

According to its self-reported version number, the version of PHP installed on the remote host is 7.3.x prior to 7.3.27, 7.4.x prior to 7.4.15, or 8.x prior to 8.0.2. It is, therefore, affected by a null dereference when XML is provided to the SoapClient query function without an existing field...