CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-104667

The Animated Number Counters WordPress plugin (versions before 3.1 ) is vulnerable to a second-order SQL injection (CWE-89). The root cause is the failure to sanitize or escape values stored by a user with Editor-level privileges before they are concatenated into a SQL query. This query is execut...

EUVD-2026-94182

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

PT-2026-107407

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

PT-2026-107754

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission...

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission...

PT-2026-107405

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2017-11882

نظرة عامة على CVE-2017-11882 من حيث تأثير الاستغلال، يمكنه اختراق جميع إصدارات Office من 2003 إلى 2016، وبناء بيئة الهجوم بسيط للغاية. ينجم هذه الثغرة عن محرر المعادلات داخل برنامج Office، حيث لا يتحقق عملية المحرر من طول الاسم، مما يؤدي إلى تجاوز سعة المخزن المؤقت، ويمكن للمهاجم تنفيذ تعليمات...

CVE-2026-34212

CVE-2026-34212 قام Docmost بقبول رابط javascript: داخل عقدة مرفق، وحافظ عليه من خلال التخزين والعرض، ثم حوله مرة أخرى إلى رابط قابل للنقر في نطاق Docmost. مقدمة لقد حددت، وكشفت بطريقة مسؤولة، وأعدت إنتاج مشكلة XSS مخزنة عالية الخطورة في Docmost ، منصة التوثيق التعاونية مفتوحة المصدر. يقدم الموقع...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

cve-2019-17497

CVE-2019-17497 Détails CVE PDF-XChange Editor avant la version 8.0.330.0 présente une vulnérabilité de vol de hash NTLM SSO via des fichiers FDF ou XFDF spécialement conçus un problème lié à CVE-2018-4993. Par exemple, un hash NTLM est envoyé pour un lien vers \attacker.loca\C$\eee.pdf sans...

CVE-2026-48907

CVE-2026-48907 CVE-2026-48907 هو ثغرة حرجة في التحكم في الوصول غير الصحيح في إضافة محرر JCE لـ Joomla. تسمح للمهاجمين غير الموثّقين بإنشاء ملفات تعريف محرر جديدة، مما قد يؤدي في النهاية إلى رفع ملف PHP تعسفي وتنفيذ تعليمات برمجية عن بُعد على الأنظمة المتأثرة. أيضًا إذا كنت تريد ويب شيل، يمكنك...

CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

EUVD-2026-93026

Editor Remote Code Execution RCE in Tabs = 2.5 versions...

CVE-2026-73321

CVE-2026-73321: PHP worker stack overflow through nested BBCode XenForo before 2.3.13 can exhaust a PHP worker through deeply nested BBCode. Result The public editor/to-html route sends guest-supplied BBCode through XenForo's recursive parser and renderer. It does not apply a raw-length or nestin...

WP < 7.1.3 - Contributor+ DoS via Block Editor URL Details

Description WordPress does not correctly handle some malformed relative URL paths while resolving them in some cases, which could allow users with Contributor-level access and above to trigger an uncontrolled loop and cause a denial of service through server worker exhaustion...

The vulnerability of Visual Studio Code’s source editor, related to the occurrence of interpretation conflicts, allows attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to the occurrence of interpretation conflicts. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

The vulnerability of Visual Studio Code’s source editor, related to the use of a name with an incorrect reference, allows attackers to gain unauthorized access to protected information.

The vulnerability of Visual Studio Code’s source editor is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow an attacker, working remotely, to gain unauthorized access to protected information...