CVE-2026-115252: Unknown Confection WordPress Cable: The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks…

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the...

CVE-2026-73695 Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject...

PT-2026-135483

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 1.16 Description A path traversal issue exists in the services/users/index.php endpoint. This occurs because the module name parameter is not properly sanitized before being concatenated into an include path...

CVE-2026-73695: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in…

Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject...

CVE-2026-44344

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...

CVE-2026-44344

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple "eval" calls in the vendored PEAR "HTMLQuickForm" libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo for...

EUVD-2026-113999

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...

PT-2026-133603

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTML QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms...

CVE-2026-44344: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...

WordPress Email Customizer for WooCommerce has a vulnerability related to input validation errors.

The WordPress Email Customizer for WooCommerce version 3.9.5 and earlier has a vulnerability in input validation. This vulnerability stems from insufficient authorization and input cleansing in the sendtestmail function. It allows user-controlled PHP code to be written into executable files in th...

CVE-2026-103367

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...

CVE-2026-104909

The Mang Board plugin for WordPress (versions up to and including 2.4.3 ) is vulnerable to Local File Inclusion (LFI) via the _type parameter. The root cause is the lack of nonce or capability checks on the shortcode render path for the public [mb_board] shortcode. Unauthenticated attackers can e...

EUVD-2026-100853

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

PT-2026-113681

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

CVE-2026-86787: Improper Control of Generation of Code

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

PT-2026-113713

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the ' type e.g. foo type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

EUVD-2026-99209

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting XSS. When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker...

CVE-2026-54454

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessib...

PT-2026-111818

Name of the Vulnerable Software and Affected Versions Shopware version 6.7 Description Shopware allows the upload of attacker-controlled HTML files which are served as text/html without effective security headers, such as Content-Security-Policy or X-Content-Type-Options: nosniff. This leads to...

CVE-2026-104937: Undefined Security Weakness

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting XSS. When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker...