CVE-2026-4912

CVE-2026-4912 : The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 7.0.3. The vulnerability is caused by get_urls_from_html() using DOMDocument::loadHTMLFile() to fetch iframe source URLs with an insuffici...

CVE-2026-15444 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

EUVD-2026-49756

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63303 Path Traversal in Quick.CMS

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63302

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

EUVD-2026-49755

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

EKC Tournament Manager WordPress plugin - Path Traversal

EKC Tournament Manager WordPress plugin 2.2.2 contains a path traversal caused by insufficient validation, letting logged in admin users download system files outside the WordPress directory. id: CVE-2024-9765 info: name: EKC Tournament Manager WordPress plugin - Path Traversal author: Sourabh-Sa...

CVE-2026-65707

Likeshop 3.0.5 is affected by an authenticated SQL injection in the adjustAccount endpoint. The UserLogic.php adjustAccount function concatenates money, integral, growth, and earnings directly into Db::raw() fragments without type casting, validation, or parameter binding, enabling an admin-level...

CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-15724

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on...

pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

CVE-2026-42168

The CVE covers django-pyas2 up to version 1.2.3, where the Partner model’s cmd_receive and cmd_send fields are passed directly to os.system() in pyas2/utils.py. The underlying vulnerability is OS command injection, exploitable when an AS2 message is received or sent, allowing an authenticated adm...

CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-53449

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53448

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The issecurestring filter that protects the STUN protocol path is not...

DEBIAN-CVE-2026-53448

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The issecurestring filter that protects the STUN protocol path is not...

CVE-2026-53449

CVE-2026-53449 — Coturn : Before 4.13.0, the psd print sessions dump CLI command accepts a filename argument and passes it directly to fopen without path validation, enabling an authenticated admin with CLI access to overwrite arbitrary files writable by the coturn process with session dump data....