33779 matches found
CVE-2026-112379
The Codepeople Contact Form Email (contact-form-to-email) WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.3.68 . The flaw stems from the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious...
CVE-2026-103234
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided us...
CVE-2026-103234 WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided us...
EUVD-2026-108009
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided us...
CVE-2026-103234
The WP Ultimate Review WordPress plugin (versions before 2.4.5 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is a failure to neutralise shortcodes in specific review fields submitted via the plugin's public review form. An unauthenticated visitor can submit a r...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell !Authorhttps://img.shields.io/badge/Author-l3tc...
CLEANSTART-2026-KI18725 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes
CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...
CVE-2026-29001
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...
CVE-2026-29001 TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...
CVE-2026-29001 TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...
EUVD-2026-107571
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...
CVE-2026-29001
TastyIgniter versions up to and including 4.4.5 are vulnerable to a PHP object injection vulnerability. The root cause is the unsanitized storage and subsequent unserialization of settings values via the getValueAttribute() function. Authenticated administrators can exploit this by submitting a s...
CVE-2026-113789
A flaw was found in pypdf. A remote attacker can exploit this vulnerability by supplying a specially crafted PDF document that triggers excessive memory consumption and long processing times when an application reads form fields. This issue can result in a Denial of Service DoS, potentially causi...
CVE-2026-114265
The ProjectWorlds Advanced Library Management System 1.0 is vulnerable to SQL injection via the Search Form component. The flaw exists in the mysqli_query function within the returned_book_search.php file, where improper handling of the datefrom and dateto arguments allows for remote execution. P...
EUVD-2026-107425
A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqliquery of the file returnedbooksearch.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be...
DEBIAN-CVE-2026-113789
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0...
CVE-2026-113789
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0...
CVE-2026-113789 pypdf: Possible long runtimes/large memory usage when retrieving form fields
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0...
CVE-2026-113789
The pypdf pure-python PDF library is vulnerable to uncontrolled resource consumption (CWE-400, CWE-407) in versions prior to 6.21.0 . An attacker can craft a malicious PDF file that triggers large memory usage or long runtimes when an application attempts to retrieve the document's form fields . ...
CVE-2026-113789 pypdf: Possible long runtimes/large memory usage when retrieving form fields
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0...