CVE-2026-89288 Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

EUVD-2026-100860

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin < 4.7.14 - Subscriber+ Arbitrary Album Media Injection vulnerability

Subscriber+ Arbitrary Album Media Injection vulnerability discovered by Lawal Qasim in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions 4.7.14...

CVE-2026-89288

The Fast Courier WordPress plugin, versions 5.0.0 through 5.2.3 , is vulnerable to unauthenticated SQL injection . The flaw exists because the plugin fails to sanitize and escape values provided via the 'wp_order_id' parameter on an unauthenticated REST route. An unauthenticated attacker can expl...

EUVD-2026-100853

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

CVE-2026-107594 File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...

CVE-2026-107508 Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file...

EUVD-2026-100893

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...

EUVD-2026-100892

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file...

CVE-2026-107594

The File Upload to Order WordPress plugin, prior to version 1.1.4 , is vulnerable to unauthenticated arbitrary file deletion . The flaw occurs because the plugin fails to validate or confine a file path derived from attacker-controlled session data before performing a deletion action. Since this ...

CVE-2026-106166 NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-106166

The NEX-Forms WordPress plugin versions before 9.3.1 is vulnerable to unauthenticated arbitrary form entry modification. The flaw exists because the plugin fails to perform authorization, ownership, or request-validation checks before updating stored entries. An unauthenticated attacker can use t...

EUVD-2026-100880

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...

CVE-2024-20767

CVE-2024-20767 CVE-2024-20767 - Arbitrary file system read using an Improper Access Control vulnerability in Adobe ColdFusion Please refer to ma4ter blogpost for more information: Adobe ColdFusion任意文件读取漏洞CVE-2024-20767分析 Products and Versions affected: Product| Affected Versions ---|--- ColdFusio...

CVE-2026-105429

Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Legal disclaimer : this code is provided for educational purposes and for authorized testing only CTF, bug bounty, private lab. The author is not responsible for any illegal use. Description Krayin CRM Webkul ≤ 2.2.x exposes the...

CVE-2026-105429

Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...

CVE-2026-34990-poc

CVE-2026-34990 CUPS 2.4.16 local privilege escalation via arbitrary file write through CUPSCREATELOCALPRINTER. Vulnerability CUPS allows creating local printers with a device-uri set to a file:// path. Submitting a print job with document-format: application/vnd.cups-raw and compression: gzip...

CVE-2024-2928

CVE-2024-2928 Arbitrary file read exploit for CVE-2024-2928 in mlflow specifically in version 2.9.2, which was fixed in version 2.11.3 The exploit code tested on Linux Source: https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298 Usage python3 CVE-2024-2928.py -t 127.0.0.1 -p 5000 After...

CVE-2024-43468_mTLS_go

CVE-2024-43468 SCCM SQL Injection Exploit mTLS client certs from MacOS keychain version Go implementation of CVE-2024-43468 exploit that uses macOS Keychain for mTLS authentication without need to export keys from keychain. Additionally: Added proxy support to not use problematic proxychains. Add...