CVE-2026-31857

CVE-2026-31857 - Craft CMS RCE exploit Python exploit for a RCE vulnerability in the Craft CMS admin panel, triggered via the admin/actions/element-indexes/count-elements endpoint. The injection goes through the elementIds field of a RelatedToConditionRule condition, which gets interpreted as Twi...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2026-31857 - CraftCMS RCE exploit Python exploit for a RC...

CVE-2026-17509

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

EUVD-2026-72698

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

CVE-2026-17509 WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

CVE-2026-17509

CVE-2026-17509 is a time-based SQL Injection in the WPML Multilingual CMS WordPress plugin, affecting all versions up to and including 4.9.5 . The root cause is insufficient escaping on the elementIds parameter combined with lack of proper SQL query preparation. A compound authorization bypass —w...

CVE-2026-17509 WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

PT-2026-87028

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

CVE-2026-17509: Improper Neutralization of Special Elements used in an SQL Command

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...