CVE-2025-56430: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the deleteDirectory function...

CVE-2025-56430

Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the deleteDirectory function...

CVE-2025-56431

Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the filegetcontents function...

CVE-2020-36849: Unrestricted Upload of File with Dangerous Type

The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to...

PT-2025-13405

Name of the Vulnerable Software and Affected Versions MainWP MainWP Dashboard version 5.3.4 Description A Cross-Site Scripting XSS issue exists in the MainWP MainWP Dashboard, specifically in the class/class-mainwp-post-handler.php file. The problem arises from unsanitized user input from $...

CVE-2021-4261 pacman-canvas db-handler.php addHighscore sql injection

A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.6 is able to address this issu...

CVE-2021-4261 pacman-canvas db-handler.php addHighscore sql injection

A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.6 is able to address this issu...

PT-2022-11631

Name of the Vulnerable Software and Affected Versions pacman-canvas versions up to 1.0.5 Description A critical vulnerability has been found in pacman-canvas, affecting the addHighscore function of the file data/db-handler.php. This vulnerability leads to sql injection and can be launched remotel...

CVE-2021-4261

The CVE-2021-4261 entry concerns pacman-canvas (up to v1.0.5). The issue is an SQL injection in the function addHighscore in data/db-handler.php, enabling remote exploitation. Affected versions include 1.0.5 and earlier; upgrading to v1.0.6 addresses the vulnerability (patch hash 29522c90ca1cebfc...

CVE-2021-4261: Improper Neutralization

A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.6 is able to address this issu...

SOUND4 IMPACT/FIRST/PULSE/Eco 2.x services Command Injection

SOUND4 IMPACT/FIRST/PULSE/Eco =2.x services Authenticated Command Injection Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15 Impact/Pulse/First Version 1: 2.1/1.69 Impact/Pulse Ec...

Information Disclosure

microweber is vulnerable to information disclosure. The vulnerability exists due to a lack of sanitization in the Handler.php file allow to view sensitive information in debug mode...

Cross site request forgery (csrf)

The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the showlogssection function found in the /includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18...

CVE-2021-34661: Cross-Site Request Forgery (CSRF)

The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the showlogssection function found in the /includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18...

PT-2021-20630

Name of the Vulnerable Software and Affected Versions: WP Fusion Lite versions up to and including 3.37.18 Description: The issue allows attackers to perform Cross-Site Request Forgery via the show logs section function found in the /includes/admin/logging/class-log-handler.php file, which enable...

CVE-2020-25042

CVE-2020-25042 concerns Mara CMS 7.5 where an authenticated admin/manager can upload PHP via codebase/handler.php after invoking codebase/dir.php?type=filenew, enabling arbitrary code execution. The vulnerability is triggered by an authenticated session and a crafted request; public exploit detai...

PT-2020-8519

Name of the Vulnerable Software and Affected Versions: NETGEAR WC7500 versions prior to 6.5.3.5 NETGEAR WC7520 versions prior to 2.5.0.46 NETGEAR WC7600v1 versions prior to 6.5.3.5 NETGEAR WC7600v2 versions prior to 6.5.3.5 NETGEAR WC9500 versions prior to 6.5.3.5 Description: The issue is a...

PT-2019-14272

Name of the Vulnerable Software and Affected Versions Pvanloon1983 social network versions before 2019-07-03 Description The issue allows SQL injection in the includes/form handlers/register handler.php file. Recommendations For versions before 2019-07-03, update to a version released on or after...

PT-2019-12712

Name of the Vulnerable Software and Affected Versions The Carts Guru plugin version 1.4.5 Description The issue allows for Insecure Deserialization via a cartsguru-source cookie to the classes/wc-cartsguru-event-handler.php file. Recommendations For The Carts Guru plugin version 1.4.5, consider...

CVE-2019-12241: Deserialization of Untrusted Data

The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...