CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-104667

The Animated Number Counters WordPress plugin (versions before 3.1 ) is vulnerable to a second-order SQL injection (CWE-89). The root cause is the failure to sanitize or escape values stored by a user with Editor-level privileges before they are concatenated into a SQL query. This query is execut...

EUVD-2026-94182

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

PT-2026-107407

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

PT-2026-107754

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission...

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission...

PT-2026-107405

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2017-11882

CVE-2017-11882 अवलोकन शोषण प्रभाव के दृष्टिकोण से, यह Office 2003 से 2016 के सभी संस्करणों को प्रभावित कर सकता है, और संपूर्ण आक्रमण वातावरण का निर्माण बहुत सरल है। यह भेद्यता Office सॉफ्टवेयर के सूत्र संपादक के कारण होती है, क्योंकि संपादक प्रक्रिया नाम की लंबाई की जाँच नहीं करती है, जिससे बफर...

CVE-2026-34212

CVE-2026-34212 Docmost ने एक अटैचमेंट नोड के अंदर एक javascript: URL को स्वीकार किया, इसे स्टोरेज और रेंडरिंग के दौरान संरक्षित रखा, और इसे Docmost ओरिजिन में एक क्लिक करने योग्य एंकर में बदल दिया। परिचय मैंने Docmost , ओपन-सोर्स सहयोगी दस्तावेज़ीकरण प्लेटफ़ॉर्म में एक उच्च-गंभीरता संग्रहीत XSS...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

cve-2019-17497

CVE-2019-17497 CVE विवरण PDF-XChange Editor 8.0.330.0 से पहले के संस्करण में निर्मित FDF या XFDF फ़ाइलों का उपयोग करके NTLM SSO हैश चोरी की भेद्यता है CVE-2018-4993 से संबंधित मुद्दा। उदाहरण के लिए, बिना उपयोगकर्ता की सहभागिता के \attacker.loca\C$\eee.pdf के लिंक के लिए एक NTLM हैश भेजा जाता है।...

CVE-2026-48907

CVE-2026-48907 CVE-2026-48907 هو ثغرة حرجة في التحكم في الوصول غير الصحيح في إضافة محرر JCE لـ Joomla. تسمح للمهاجمين غير الموثّقين بإنشاء ملفات تعريف محرر جديدة، مما قد يؤدي في النهاية إلى رفع ملف PHP تعسفي وتنفيذ تعليمات برمجية عن بُعد على الأنظمة المتأثرة. أيضًا إذا كنت تريد ويب شيل، يمكنك...

CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

EUVD-2026-93026

Editor Remote Code Execution RCE in Tabs = 2.5 versions...

CVE-2026-73321

CVE-2026-73321: PHP worker stack overflow through nested BBCode XenForo before 2.3.13 can exhaust a PHP worker through deeply nested BBCode. Result The public editor/to-html route sends guest-supplied BBCode through XenForo's recursive parser and renderer. It does not apply a raw-length or nestin...

WP < 7.1.3 - Contributor+ DoS via Block Editor URL Details

Description WordPress does not correctly handle some malformed relative URL paths while resolving them in some cases, which could allow users with Contributor-level access and above to trigger an uncontrolled loop and cause a denial of service through server worker exhaustion...

The vulnerability of Visual Studio Code’s source editor, related to the occurrence of interpretation conflicts, allows attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to the occurrence of interpretation conflicts. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

The vulnerability of Visual Studio Code’s source editor, related to deficiencies in HTTP request processing, allows attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...