CVE-2026-16990

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-16990 Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-16990

The CVE concerns the WordPress plugin “Payment Button for PayPal” (versions up to 1.2.3.44). The root cause is that the plugin does not enforce the merchant-configured price server-side and trusts the amount provided by the client, enabling unauthenticated attackers to create a real PayPal order ...

CVE-2026-19050

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

CVE-2026-19050

The ProSolution WP Client WordPress plugin (versions before 2.0.9 ) is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate user-supplied URLs and does not verify the requester's capability or nonce before initiating server-side HTTP requests. Th...

CVE-2026-19050 ProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

CVE-2026-16294

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

CVE-2026-16294

The PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the failure to validate one of the Podcast Episode URL settings before performing a server-side request. This flaw allows users with a rol...

CVE-2026-16294 Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

PT-2026-71256

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI...

Debian dsa-6435 : spip - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6435 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6435-1 [email protected] https://www.debian.org/security/...

PT-2026-71054

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

PT-2026-71370

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

PT-2026-71210

Name of the Vulnerable Software and Affected Versions OpenSearch Security Analytics plugin affected versions not specified Description Missing input validation in the threat intelligence feed parser allows an authenticated remote user to perform server-side request forgery SSRF—a technique where ...

PT-2026-71013

Name of the Vulnerable Software and Affected Versions PowerPress Podcasting versions prior to 11.17.1 Description Insufficient validation of a Podcast Episode URL setting allows users with Contributor privileges or higher to execute Server-Side Request Forgery SSRF attacks. This issue enables the...

CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...

PT-2026-71030

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

CVE-2026-73330: Improper Neutralization of Special Elements Used in a Template Engine

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...

PT-2026-71220

Name of the Vulnerable Software and Affected Versions ScadaLTS version 2.7.8.1 Description A server-side method lacks authorization checks, enabling any authenticated user, including those with low-privilege read-only permissions, to execute arbitrary operating system commands on the host. This...

(Pwn2Own) Home Assistant Green mDNS Server-Side Request Forgery Vulnerability

This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mDNS service. The issue results from the lack of...