PT-2026-113707

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing address.first name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .ph...

CVE-2026-55695

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater...

CVE-2026-107248

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection SSTI flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker...

CVE-2026-107248 CVE-2026-107248

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection SSTI flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker...

CVE-2026-107248

Thelia 3.0.0's back-office Email/Messages feature is vulnerable to a server-side template injection (SSTI) flaw. This issue allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates , which the system compiles and executes as raw code. An attacker can explo...

PT-2026-105994

DropzoneFileExplorer chunked upload trusts fileName all the way to fopen!! CVE-2026-104826 CVSS 8.5. v1.1. Traversal walks out of the storage root into the web root. PHP runs. Auth required unless AUTH ENABLE=false. CVE assigned 2 Oct. Fixed in v1.2. PoC dropped 3 Oct!! https://t.co/rrzsvshNEK...

CVE-2026-70356

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-34741

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

CVE-2026-34741: Missing Authentication for Critical Function

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

EUVD-2026-63199

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

CVE-2026-17533

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...

CVE-2026-55676: Unrestricted Upload of File with Dangerous Type

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-46640

Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and...

CVE-2026-9290

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the profile template scope function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...

CVE-2026-9200

The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the...

Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

Description The obj.expr dynamic-attribute syntax added in 3.15.0 as the replacement for the deprecated attribute function lets the attribute be an arbitrary expression. When the receiver is self or any % import % alias and the parenthesised expression is a string literal, DotExpressionParser...

CVE-2026-32261: Improper Neutralization of Special Elements Used in a Template Engine

Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version 3.0.0 to before version 3.2.0, the Webhooks plugin renders user-supplied template content through Twig’s renderString function without...

CVE-2022-35239

The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verification vulnerability when uploading files. If this vulnerability is exploited, arbitrary PHP code may be executed if a remote authenticated...

CVE-2025-14475

The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the extensivevcgetmoduletemplatepart function. This is due to insufficient path normalization and validation of the user-supplied...