94014 matches found
EUVD-2026-59928
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...
CVE-2026-18653
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-15056
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...
CVE-2026-19725
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 fails to sanitise a value from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site-to-site transfer key to write a file in any writable directory, including the web root....
CVE-2026-18653
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653
The WP Directory Kit WordPress plugin (versions before 1.5.7) passes the "section" parameter unsanitized into a SQL query, enabling authenticated admins to perform SQL injection. On multisite installs, a single-site admin can read data belonging to the entire network. No active exploitation is re...
EUVD-2026-59912
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653 WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-15056
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...
EUVD-2026-59900
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...
CVE-2026-15056
The CVE concerns the StoreEngine WordPress plugin (StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More). Affected: all versions up to and including 2.1.1. Vulnerability type: Directory Traversal via the parse_file_path function, allowing an authenticated attac...
PT-2026-73104
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse file path function. This makes it possible for authenticated attackers, with vendor-leve...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055 Shescape before 2.1.15 Home Directory Disclosure via BusyBox
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055 Shescape before 2.1.15 Home Directory Disclosure via BusyBox
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to escape tilde (~) characters in assignment contexts on Unix systems where the shell is configured to "sh" or true and /bin/sh points to BusyBox. Using escape and escapeAll with untrusted input in an assignment prefixed to a command can inject ...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-64607 vulnerabilities
Vulnerabilities for packages: nrjmx, cassandra-reaper, logstash, akhq, cloudwatch-exporter, sonarqube, dependency-track, opensearch, thingsboard, kserve-modelmesh, druid, apicurio-registry, trino...
CVE-2026-19903 SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has bee...