41 matches found
CVE-2026-88393
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
CVE-2026-88393: Improper Control of Generation of Code
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
PT-2026-106003
Name of the Vulnerable Software and Affected Versions WookTeam versions prior to 1.6.7 Description The project task export interface '/api/project/task/export' allows remote code execution. The data parameter is base64-decoded and passed to the string2array function in app/Module/Base.php. When t...
CVE-2026-88393
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
CVE-2026-88393
WookTeam version 1.6.6 and before is vulnerable to Remote Code Execution (RCE) via the project task export interface at /api/project/task/export. The root cause is that the data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php. This function ...
EUVD-2026-92470
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
CVE-2026-88393
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
CVE-2026-6251: Improper Neutralization of Special Elements used in an SQL Command
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
PT-2024-16216
Name of the Vulnerable Software and Affected Versions Clever Addons for Elementor plugin for WordPress versions up to, and including, 2.2.1 Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data...
CVE-2017-20187 Magnesium-PHP Base.php formatEmailString injection
UNSUPPORTED WHEN ASSIGNED A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3....
CVE-2017-20187 Magnesium-PHP Base.php formatEmailString injection
UNSUPPORTED WHEN ASSIGNED A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3....
CVE-2017-20187: Improper Neutralization of Special Elements in Output Used by a Downstream Component
UNSUPPORTED WHEN ASSIGNED A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3....
CVE-2021-38352
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedifymsg parameter found in the /includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8...
Cross site scripting
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedifymsg parameter found in the /includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8...
CVE-2021-38352
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedifymsg parameter found in the /includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8...
CVE-2021-38352: Improper Neutralization of Input During Web Page Generation
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedifymsg parameter found in the /includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8...
PT-2021-22072
Name of the Vulnerable Software and Affected Versions The Feedify – Web Push Notifications WordPress plugin versions up to and including 2.1.8 Description The issue allows attackers to inject arbitrary web scripts via the feedify msg parameter found in the /includes/base.php file, enabling...
PT-2019-14661
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.3 Description The issue allows a user to extract arbitrary data from the database via a non-parameterized INSERT INTO statement. This can be achieved by exploiting the providerID parameter in the interface/forms/e...
Hive 2.0 RC2 XSS / Code Execution / SQL Injection
| Title : Hive v2.0 RC2 Multi Vulnerability | Author : indoushka | email : [email protected] | Dork : "Powered by DigitalHive" | Tested on: windows 8.1 Français V.Pro | Bug : Stop Script | Download : http:///www.digitalhive.com ======================================= Stop SCript working :...
DigitalHive <= 2.0 RC2 (user_id) Remote SQL Injection Exploit
No description provided by source. !-- Hive v2.0 RC2 Remote SQL Injection c0ded by j0j0 -- html head style type=text/css body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF;...