CVE-2026-37068

An arbitrary file write vulnerability in Veno File Manager Project 4.4.9 affects the endpoint /vfm-admin/index.php?section=translations&action=update. An authenticated user holding the super administrator role can overwrite any PHP file in the application by sending a specially crafted POST reque...

Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

GitHub Security Advisory Draft — GM-369 Summary SQL injection in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME... SQL expression without parameterization or allowlist validation. Severit...

PT-2024-24593 · Tolgee · Tolgee

Name of the Vulnerable Software and Affected Versions: Tolgee versions prior to 3.57.2 Description: Tolgee is an open-source localization platform. The issue concerns the /v2/projects/translations and /v2/projects/projectId/translations endpoints, where translation data was returned even when the...