136866 matches found
CVE-2026-93300
The EventON - Subscriber plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.4.5 . The root cause is insufficient escaping of the 'email' parameter and a lack of proper preparation for the existing SQL query. This flaw allows unauthenticated attackers to appe...
VulnCheck KEV: CVE-2014-125133
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...
VulnCheck KEV: CVE-2023-34545
A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL...
VulnCheck KEV: CVE-2012-20003
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
VulnCheck KEV: CVE-2016-20104
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd,...
VulnCheck KEV: CVE-2012-20004
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...
PT-2026-118295
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza...
PT-2026-118677
Name of the Vulnerable Software and Affected Versions NativeChurch theme for WordPress versions prior to 1.6.2 Description An issue allows unauthenticated attackers to download arbitrary files via the 'download.php' endpoint. By sending GET requests containing directory traversal sequences in the...
PT-2026-118672
Name of the Vulnerable Software and Affected Versions Custom Tables plugin for WordPress versions prior to 3.4.6 Description A reflected cross-site scripting issue exists that allows unauthenticated attackers to inject scripts into victims' browsers to steal cookies. This occurs via the unsanitiz...
PT-2026-118681
Name of the Vulnerable Software and Affected Versions Aspose PDF Exporter plugin for WordPress versions prior to 2.0 Description An issue exists where unauthenticated attackers can download files by exploiting a path traversal flaw. This occurs because the file parameter passed to the readfile...
PT-2026-118673
Name of the Vulnerable Software and Affected Versions K-news plugin for WordPress versions prior to 1.1.1 Description A reflected cross-site scripting issue allows unauthenticated attackers to inject scripts by providing unsanitized input. Attackers can send GET requests to the endpoint...
PT-2026-118678
Name of the Vulnerable Software and Affected Versions ChurcHope theme for WordPress versions prior to 2.2 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This is achieved by supplying directory traversal sequences to the file parameter of the...
PT-2026-118685
Name of the Vulnerable Software and Affected Versions JavaMelody versions prior to 1.60.0 Description A reflected cross-site scripting issue allows unauthenticated attackers to inject scripts into victims' browsers. This occurs when crafted values are supplied to the graph parameter of the...
PT-2026-118680
Name of the Vulnerable Software and Affected Versions Aspose Importer & Exporter plugin for WordPress versions prior to 3.0 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This occurs because the file parameter is not properly sanitized. Attackers...
PT-2026-118679
Name of the Vulnerable Software and Affected Versions Aspose Doc Exporter plugin for WordPress versions prior to 2.0 Description An issue allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to the readfile function. This is achieved by sending GET requests to...
PT-2026-118241
Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5 Description Remote authenticated attackers can perform IMAP command injection by injecting CRLF sequences into the uid parameter of the 'mail/headers' a...
PT-2026-118686
Name of the Vulnerable Software and Affected Versions Cherry Plugin for WordPress versions prior to 1.2.7 Description An issue allows unauthenticated attackers to download arbitrary files. This occurs because the script passes input directly to the readfile function without proper validation...
VulnCheck KEV: CVE-2014-125134
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitiv...
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery SSRF vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with...
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery SSRF vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and...