Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible printphpinformation.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PH...

CVE-2024-6529

Proof of Concept PoC for Vulnerabilities in WordPress Plugins This repository contains Proof of Concept PoC scripts for various vulnerabilities discovered in different WordPress plugins. These scripts demonstrate how attackers can exploit these vulnerabilities to perform malicious actions. Table ...

CVE-2026-96647

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96647 Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-91255

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96647

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.1.1 . The root cause is insufficient input sanitization and output escaping of the 'lsd[remark]' parameter. This a...

PT-2026-104146

Name of the Vulnerable Software and Affected Versions Listdom: AI-powered Business Directory with Classifieds Ads Listings versions prior to 6.1.2 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. Authenticated attackers with...

Dark_Ledger

Dark Ledger Este repositorio sirve como un archivo de información sobre mercados de la darknet, incluyendo: Listas de vendedores Claves PGP de vendedores Publicaciones y descripciones Estructura del mercado y otros datos relevantes CDN Si buscas descargar "The Darknet Market Archives" de Gwern.ne...

OpenStack Swift vulnerable to authenticated server-side request forgery

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

CVE-2026-102990

A flaw was found in basic-ftp. A malicious or compromised FTP server can cause a Denial of Service DoS by returning specially crafted Unix directory listings to the client. Inefficient regular expression processing during directory parsing leads to excessive CPU consumption, blocking the...

EUVD-2026-89669

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-6806 Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Linux Distros Unpatched Vulnerability : CVE-2026-102601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by...

CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601

The Flysystem PHP file storage library is vulnerable in versions prior to 3.35.3 due to a flaw in the WhitespacePathNormalizer component. The root cause is that preg_match with the u modifier treats false (returned during malformed UTF-8 input) as falsy, allowing paths containing control characte...

CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

EUVD-2026-88998

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...