CVE-2026-42289 ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation

ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an...

CVE-2023-46509

An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component...

VulnCheck KEV: CVE-2013-2618

Cross-site scripting XSS vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inject arbitrary web script or HTML via the maptitle parameter...

SPAW Editor PHP Edition

Remote IInclude File : SPAW Editor PHP Edition upgrade version 1.2.3 to 1.2.4 Discovered By : Hasadya Raed Contact Me : RaeDatBsdMaildotCom Download Script: http://heanet.dl.sourceforge.net/sourceforge/spaw/spaw-php-123-to-124.zip B.File :imglibrary.php : include $spawroot.'class/util.class.php';...

CVE-2006-5291

PHP remote file inclusion vulnerability in admin/includes/spaw/spawcontrol.class.php in Download-Engine 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the spawroot parameter. NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PH...