233 matches found
CVE-2024-22641
CVE-2024-22641 Vulnerability Type Regular expression Denial of Service ReDoS Affected Product and Version TCPDF root@kitploit: AddPage; $pdf-ImageSVG$file='poc.svg'; ?...
CVE-2024-22640
CVE-2024-22640 Vulnerability Type Regular expression Denial of Service ReDoS Affected Product and Version TCPDF convertHTMLColorToDec'"t"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000!',$ref; ? Note: Checking with...
CVE-2026-19887
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...
CVE-2026-19887 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...
CVE-2026-19887
The Welcart e-Commerce plugin for WordPress (versions up to 2.12.1 ) is vulnerable to PHP Object Injection via the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary serialized data as order metadata during a public checkout, then trigger...
EUVD-2026-71883
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...
PT-2026-86327
Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.2 Description PHP Object Injection occurs due to the deserialization of untrusted input within the Telecom EDY payment callback usces action acting transaction. Unauthenticated...
CVE-2026-76210
phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...
EUVD-2026-62451
phpMyFAQ before 4.1.7 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...
CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export
phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...
CVE-2026-76210
phpMyFAQ before 4.1.6 (some sources cite 4.1.7) contains an inadequate HTML sanitization flaw in FAQ answers before PDF generation via TCPDF . An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory (e.g...
CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export
phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...
PT-2026-78392
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient sanitization of HTML in FAQ answers occurs before generating PDFs via TCPDF. An attacker with permissions to create or edit FAQ content can embed an tag with a src attribute referencing...
EUVD-2017-15165
Malware in sbrugna...
EUVD-2024-3609
Malicious code in bioql PyPI...
EUVD-2024-3587
Malicious code in bioql PyPI...
EUVD-2024-3555
Malicious code in bioql PyPI...
EUVD-2024-3618
Malicious code in bioql PyPI...
EUVD-2024-3571
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2017-6100
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP. CVE-2017-6100 Note that Nessus relies on the presence of the package a...