PT-2026-102767

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A heap-buffer-overflow occurs when a DHCP server or a malicious actor on the local area network responds to a DISCOVER message. The issue stems from an incorrect...

CVE-2026-18049

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...

CVE-2026-64403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

ROS-20260714-73-0008

The vulnerability of the dissectcontroloptionvalue function in the SANE protocol analyzer, Wireshark, for analyzing computer network traffic, is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2026-14482

The CVE-2026-14482 entry covers the WordPress plugin “多说社会化评论框” (

EUVD-2015-9338

Malware in sbrugna...

CVE-2025-38529 comedi: aio_iiro_16: Fix bit shift out of bounds

In the Linux kernel, the following vulnerability has been resolved: comedi: aioiiro16: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if 1 options1 & 0xdcfc However, it-optionsi is an unchecked int value from userspace, so the shift amount could ...

CVE-2015-9498

The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value...

CVE-2024-12059

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the elioptionvalue shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...

PT-2024-17420 · WordPress · Elementinvader Addons For Elementor

Name of the Vulnerable Software and Affected Versions: ElementInvader Addons for Elementor plugin for WordPress versions up to and including 1.3.1 Description: The issue allows authenticated attackers with Contributor-level access or higher to extract arbitrary options from the wp options table...

CVE-2022-3383

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the getoptionvaluefromcallback function that accepts user supplied input and passes it through calluserfunc. This makes it possible for authenticated attackers, with...

PT-2020-23055

The Webform module allows site builders to create forms. The module doesn't sufficiently prevent malicious code from being render via an options elements i.e select menu, checkboxes, radios, etc... under the scenario where the site builder allows the raw option value to be displayed. This...

CVE-2015-9498

The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value...

CVE-2015-9498

The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value...

PT-2019-7457

Name of the Vulnerable Software and Affected Versions wps-hide-login plugin versions prior to 1.1 Description The issue affects the saving of an option value and is related to CSRF. Recommendations For versions prior to 1.1, update to version 1.1 or later to resolve the issue...

CVE-2015-9498: Cross-Site Request Forgery (CSRF)

The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value...

WPS Hide Login 1.0 - CSRF

CSRF security issue when saving option value in single site and multisite mode...

PT-2017-6603

Name of the Vulnerable Software and Affected Versions WP EasyCart plugin versions 1.1.30 through 3.0.20 Description The issue allows remote attackers to gain administrator privileges and execute arbitrary code. This is achieved via the option name and option value parameters in the ec ajax update...