CVE-2025-69105: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Modernee = 1.6.0 versions...

WordPress Plugin: integrate-google-drive: CVE-2024-32949: Missing Authorization

Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Integrate Google Drive: from n/a through 1.3.8...

CVE-2026-24610: Missing Authorization

Subscriber Broken Access Control in MetForm Pro = 3.9.1 versions...

CVE-2026-39595: Missing Authorization

Author Broken Access Control in W3 Total Cache = 2.9.1 versions...

CVE-2026-49075: Deserialization of Untrusted Data

Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...

CVE-2026-54186: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in JobSearch = 3.2.9 versions...

CVE-2026-10839: URL Redirection to Untrusted Site

Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs generated by the application. A successful exploit could redirect authenticated users to malicious sites following login procedures or...

CVE-2025-69141: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Kelly Young = 1.1.0 versions...

CVE-2025-69162: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Grecko = 5.17 versions...

CVE-2026-39443: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...

CVE-2025-69178: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Truemag = 4.3.14.2 versions...

CVE-2026-12567: Improper Link Resolution Before File Access

The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...

CVE-2025-69113: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Nexio = 1.10.0 versions...

CVE-2026-39590: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Atomlab = 2.4.5 versions...

WordPress Theme: neuronet: CVE-2025-58952: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Unauthenticated Local File Inclusion in Neuronet 1.14.0 versions...

CVE-2026-52706: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...

CVE-2026-40755: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in TechLink = 1.3 versions...

vulnerability-scanner

vulnerability-scanner A...

Exploit for CVE-2026-32488

CVE-2026-32488 UpdraftPlus Auto-Exploit & Mass Scanner A...

CVE-2026-22313: Improper Neutralization of Special Elements used in an OS Command

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying...