EUVD-2026-51725

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...

CVE-2022-43708

CVE-2022-43708 affects MyBB 1.8.31. The issue is a cross-site scripting vulnerability in the post Attachments interface that lets an attacker inject HTML by tricking a user into uploading a file with a specially crafted name. Root cause noted as insufficient input filtering/escaping for attachmen...