EUVD-2026-111608

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...

CVE-2026-109218 Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...

CVE-2026-109218

The Contact Manager plugin for WordPress (versions up to and including 9.1.2 ) is vulnerable to Arbitrary File Upload via the add_message function. The root cause is an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation rou...

CVE-2024-51144

Cross Site Request Forgery CSRF vulnerability exists in the 'pvmsg.php?action=addmessage', pvmsg.php?action=confirmdelete , and ajax.server.php?page=user&action=flipfollow endpoints in Ampache = 6.6.0...

PT-2023-16754 · Sourcecodester · Sourcecodester Online Catering Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Catering Reservation System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Online Catering Reservation System. This issue affects the file /reservation/add message.php of the...