WordPress wp-login.php Code Execution

The vulnerability of the wp-login.php file in the WordPress content management system is related to the lack of security measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-76552

Name of the Vulnerable Software and Affected Versions Winter versions prior to 1.2.13 Description Custom CSS provided through the Brand Settings Styles field is compiled by the LESS parser and rendered without sanitization on every backend page. This allows a user with the backend.manage branding...

CVE-2026-72782

creationtimestamp| type| source ---|---|--- 2026-08-11 20:45:14+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-craft-cms-1...

CVE-2026-72781

creationtimestamp| type| source ---|---|--- 2026-08-11 20:45:12+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-craft-cms-1...

CVE-2026-72780

creationtimestamp| type| source ---|---|--- 2026-08-11 20:45:09+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-craft-cms-1...

CVE-2026-72779

creationtimestamp| type| source ---|---|--- 2026-08-11 20:45:07+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-craft-cms-1...

CVE-2026-72778

creationtimestamp| type| source ---|---|--- 2026-08-11 20:45:05+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-craft-cms-1...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via parameter confusion in the UsersController. An attacker can overwrite another user's credentials, including administrator passwords, by sending a crafted PATCH request to the...

Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xxpx-f366-4xpq. This link is maintained to preserve external references. Original Description Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding on...

Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5wm-88jv-g5hx. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution...

GHSA-CC2G-26RW-G997 Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-596p-6jv8-775v. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and...

GHSA-H784-HPJP-2RRM Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5wm-88jv-g5hx. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution...

Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-596p-6jv8-775v. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and...

GHSA-4HC4-QJFX-WJF3 Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xxpx-f366-4xpq. This link is maintained to preserve external references. Original Description Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding on...

GHSA-9W6W-8X3C-HFQP Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7hxc-f267-h5q7. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal...

Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7hxc-f267-h5q7. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal...

GHSA-W36C-QXRQ-V7FW Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references. Original Description Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code...

Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references. Original Description Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code...

Duplicate Advisory: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-957r-qf9p-67xw. This link is maintained to preserve external references. Original Description Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The creat...

GHSA-2P2V-3MJG-GFPF Duplicate Advisory: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-957r-qf9p-67xw. This link is maintained to preserve external references. Original Description Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The creat...