MetInfo CMS <= 8.1 - Remote Code Execution

MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests. id: CVE-2026-29014 info: name: MetInfo CMS = 8....

HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the wooftextsearch AJAX action. This makes it possible for unauthenticated attackers to include and...

Citrix SD-WAN Center - Local File Inclusion

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...

CVE-2022-29359

School Club Application System Issue: Unauthenticated Stored Cross-Site Scripting to HTML injection to RCE Author: Zak Clifford Date: 12.04.2022 Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html Software:...

CVE-2026-61564

The AVideo video-sharing platform is vulnerable to PHP code injection and SQL injection in the unauthenticated installer endpoint install/checkConfiguration.php prior to version 8.1.0 . The root cause is the lack of escaping when interpolating request parameters, such as webSiteRootURL, into sing...

CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2018-16370

CVE-2018-16370 In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive.More details see https://github.com/lazyphp/PESCMS-TEAM/issues/2...

CVE-2026-110185

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

CVE-2026-110185 Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

CVE-2026-110185 Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

EUVD-2026-111610

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

PT-2026-127873

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

CVE-2026-58256

The resource management and reservation application GRR is vulnerable to Remote Code Execution (RCE) via PHP code injection in versions prior to 4.5.0 . An administrator can inject malicious PHP by using LDAP connector configuration parameters, such as ldap_filter, to poison the /personnalisation...

CVE-2026-58256 GRR vulnerable to Remote Code Execution Via PHP Code Injection

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldapfilter, poisoning /personnalisation/configldap.inc.php and permitting remote code...

CVE-2026-58256 GRR vulnerable to Remote Code Execution Via PHP Code Injection

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldapfilter, poisoning /personnalisation/configldap.inc.php and permitting remote code...

CVE-2026-77647

CVE-2026-77647 SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code 🔴 CVE-2026-77647 — SPIP Unauthenticated Remote Code Execution Pre-Authentication Remote Code Execution in SPIP CMS — All Versions Before 4.4.20 📋 Overview CVE-2026-77647 is a critical unauthenticat...

myDBR — Admin File-Editor PHP Code Injection RCE — Detect

Fingerprint / reachability check for myDBR — Admin File-Editor PHP Code Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for myDBR — Admin File-Editor PHP Code Injection RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Exploit for CVE-2026-77647

CVE-2026-77647 SPIP before 4.4.20 allows unauthenticated remot...

CVE-2026-115251 Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network...

WordPress Duplicator plugin < 5.0.0 - Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability

Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability discovered by Charles Vosburgh in WordPress Plugin Duplicator versions 5.0.0...