459646 matches found
CVE-2026-89294
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
CVE-2019-12735-VIM-NEOVIM
CVE-2019-12735-VIM-NEOVIM USAGE: Prerequisite: modeline feature must be enabled. For regular users, modeline is enabled by default, while for root users it is disabled by default. Use echo &modeline to check the status: 1 means enabled, 0 means disabled. If not, you can add set modeline to /.vimr...
CVE-2026-97150
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...
CVE-2026-97150
The BcAddonMigrator plugin in baserCMS (provided by baserCMS Users Community) is vulnerable to an Inclusion of Functionality from Untrusted Control Sphere (CWE-829). During the conversion of baserCMS4-style addons to baserCMS5-style ones, the BcAddonMigrator incorrectly includes the config.php fi...
CVE-2026-97150
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...
EUVD-2026-89656
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...
CVE-2026-97150
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...
WordPress Simply Schedule Appointments plugin <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion vulnerability
Authenticated Subscriber+ Local File Inclusion vulnerability discovered by crow in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.27...
cve-2019-14206-poc
CVE-2019-14206 - Adaptive Images for WordPress Arbitrary File Deletion 📋 Index 1. About the Vulnerability 2. Prerequisites 3. Installation 4. Testing Methods Quick Test Full Test with Docker Test with Nuclei Manual Test 5. Interpreting Results 6. Cleanup 7. Troubleshooting 8. Mitigation 9. Legal...
cve-2025-65099
Proof of Concept for CVE-2025-65099 Further details are provided in the published article. yarnPath Technique A vulnerable environment for yarnPath can be initialized as follows: docker run --rm -v "$PWD":/poc -it --workdir /poc ubuntu bash -c 'apt-get update -qq && DEBIANFRONTEND=noninteractive...
CVE-2026-89294
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.6.12.27 . The root cause is the 'ssa_locale' parameter, which processes raw GET values without nonce or capability checks during the plugins_loaded action. While...
CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
EUVD-2026-89654
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.
Summary IBM Edge Data Collector uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed in the Vulnerability Details section below. This bulletin provides information about the affected components and the remediation for these...
CVE-2026-92994
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...
CVE-2026-91072
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...
CVE-2026-85573
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...
CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...
EUVD-2026-89622
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...