639 matches found
EUVD-2026-51396
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...
CVE-2026-14936
The CVE concerns the Simple Membership WordPress plugin prior to version 4.7.7, where PayPal IPN verification is not performed against the site’s configured merchant account before activating a membership. This allows unauthenticated users to activate or extend memberships using PayPal payments t...
CVE-2026-66712
CVE-2026-66712 affects the WordPress plugin Simple Membership versions
Exploit for CVE-2025-48932
CVE-2025-48932-Invision-Community-SQLi-Exploit CVE-2025-48932...
SQL Injection
Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to SQL Injection in the deleteBatch process when used with where conditions. An attacker can execute arbitrary SQL commands by supplying...
CVE-2026-63223
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...
CVE-2026-63221
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
UBUNTU-CVE-2026-63223
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...
CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...
CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...
CVE-2026-59551
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59549
Affected software: WordPress plugin rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.10). Vulnerability: Unauthenticated SQL Injection. Root cause/impact: SQL injection that does not require authentication; CVSS metrics in the external record indicate high confidentiality impact ...
EUVD-2026-49218
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2024-58355 Cal.com through 4.7.15 Cross-Site Scripting via booking questions
Cal.com calcom/cal.diy versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view e.g., https://app.cal.com/booking/ renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can...
CVE-2024-58355
Cal.com (calcom/cal.diy) versions up to 4.7.15 are affected by a stored XSS in the booking flow. The vulnerability occurs in the single booking view where booking-question labels are rendered via React’s dangerouslySetInnerHTML without sanitization, allowing an attacker who can create an event ty...
EUVD-2026-48081
Unauthenticated Broken Access Control in AWP Classifieds = 4.4.7 versions...
CVE-2026-47057
The CVE-2026-47057 entry concerns Oracle Java SE (Scripting) with affected versions listed as 8u491, 8u491-perf, and 11.0.31. The vulnerability is exploitable over the network via multiple protocols and can allow an unauthenticated attacker to cause a hang or crash (complete DOS). The flaw can be...
CVE-2026-47048
CVE-2026-47048 affects Oracle PeopleSoft Enterprise PeopleTools (component: Security) with affected versions 8.61 and 8.62. The issue is exploitable with network access via HTTP by a low-privilege attacker and requires user interaction. Successful attacks can lead to unauthorized read/update/inse...