EUVD-2026-100860

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-88927 rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to...

EUVD-2026-100850

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...

WordPress Sunshine Photo Cart plugin < 3.7.4 - Unauthenticated Content Injection vulnerability

Unauthenticated Content Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin Sunshine Photo Cart versions 3.7.4...

CVE-2026-108069 Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...

CVE-2026-108069

The Sunshine Photo Cart WordPress plugin (versions before 3.7.4 ) is vulnerable to unauthenticated content injection due to a lack of permission checks in the sunshine_modal_add_comment() function. While the plugin correctly validates access when displaying comments, it fails to verify if a visit...

CVE-2026-107160

The LTL Freight Quotes – Old Dominion Edition WordPress plugin (versions before 4.2.19 ) is vulnerable to unauthenticated stored HTML injection . The flaw exists because the plugin fails to perform proper authorization checks or input sanitization before storing specific request values. This allo...

CVE-2026-107160 LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront...

EUVD-2026-100888

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront...

WordPress LTL Freight Quotes plugin < 4.2.19 - Unauthenticated Stored HTML Injection vulnerability

Unauthenticated Stored HTML Injection vulnerability discovered by Ryan Fabella in WordPress Plugin LTL Freight Quotes – Old Dominion Edition versions 4.2.19...

CVE-2026-103307

The Walletdoc Payment Gateway for WooCommerce WordPress plugin, in versions prior to 1.8.5 , is vulnerable to unauthenticated SQL injection and order payment forgery . The root cause is a failure to properly sanitize and escape user input before using it in SQL statements, combined with a default...

CVE-2026-103307 Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

EUVD-2026-100875

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within th...

UBUNTU-CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within th...

CVE-2023-40933-PoC

CVE-2023-40933 The sqlmap payload to exploit CVE-2023-40933 Payload Required Information: Valid Username and Password Domain and path of hosted instance sqlmap -D nagiosxi -T xiusers -u "https:///nagiosxi/admin/bannermessage-ajaxhelper.php?action=updatebannermessagesettings&id=3&token=curl -ksX...

CVE-2026-46449

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

CVE-2026-110455

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

CVE-2026-101926

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...

CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...