111927 matches found
CVE-2026-81347 Frontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...
EUVD-2026-70908
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...
WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.134 - Admin+ File Write Outside the Backup Directory vulnerability
Admin+ File Write Outside the Backup Directory vulnerability discovered by reconnaissance in WordPress Plugin WPvivid Backup and Migration versions 0.9.134...
CVE-2026-82193 WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...
CVE-2026-81347
The Frontend Admin by DynamiApps WordPress plugin, versions prior to 3.29.13 , is vulnerable to an unauthenticated directory path traversal. The root cause is a failure to properly validate a user-controllable directory path before deleting files, allowing attackers to delete index.php and .htacc...
CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-81347 Frontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...
WordPress Hummingbird Performance plugin < 3.21.2 - Admin+ Network-Wide RCE vulnerability
Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Hummingbird versions 3.21.2...
PT-2026-86224
Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM On-Prem Management interface affected versions not specified Description A missing authorization issue in the management interface allows a user with Admin privileges to escalate their permissions to...
PT-2026-86257
An authenticated remote code execution RCE vulnerability in the admin config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...
PT-2026-85503
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.10.55 Description A path traversal issue exists in the admin plugin's Save As action due to improper validation of the language code parameter. An authenticated admin user with admin.pages.create permission can use...
PT-2026-85517
GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf handle download function accepts parameters prefixed with v del and appends their values directly to the base configuration directory path without sanitizing for...
CVE-2026-85601: Improper Neutralization of Input During Web Page Generation
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
PT-2026-85501
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
PT-2026-86205
Name of the Vulnerable Software and Affected Versions ILIAS versions prior to 9.22 ILIAS versions prior to 10.10 ILIAS versions prior to 11.3 Description A SQL injection issue exists in the repository trash table. The system fails to validate the table navigation sort field from HTTP requests...
PT-2026-85420
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
PT-2026-85500
Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...
CVE-2026-81347: External Control of File Name or Path
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...
CVE-2026-75169: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...
PT-2026-85421
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...