3671 matches found
CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...
CVE-2026-85200
GEO my WP is a WordPress plugin vulnerable to an unauthenticated Local File Inclusion (LFI) in all versions up to and including 4.5.5.3 , via the gmw_posts_locator_ajax_info_window_loader function. An attacker can include and execute arbitrary .php files on the server, enabling bypass of access c...
CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...
CVE-2026-84063
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed...
EUVD-2026-75229
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...
CVE-2026-84063
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed...
CVE-2026-84063: Unrestricted Upload of File with Dangerous Type
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...
PT-2026-89257
Name of the Vulnerable Software and Affected Versions BurgerEditor versions 3.2.0 through 3.4.0 Description An issue exists allowing the unrestricted upload of files with dangerous types. An authenticated attacker can upload arbitrary files, which may lead to the execution of arbitrary PHP code o...
Multiple vulnerabilities in baserCMS plugin "BurgerEditor"
Overview baserCMS plugin "BurgerEditor" provided by D-ZERO CO.,LTD. contains multiple vulnerabilities listed below: Authorization Bypass Through User-Controlled Key CWE-639 - CVE-2026-84062 Unrestricted Upload of File with Dangerous Type CWE-434 - CVE-2026-84063 Kuniyoshi Noguchi @KuniNogu report...
CVE-2026-15667
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...
CVE-2026-15667 Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...
CVE-2026-15667
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is affected by a Local File Inclusion vulnerability in all versions up to and including 4.1.22 , exploitable via the event_layout parameter. Because the etn_manage_event capability is assigned to...
CVE-2026-15406 Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level...
EUVD-2026-74568
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level...
EUVD-2026-74173
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...
Arbitrary Code Injection
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection in the sort filter due to improper handling of the isSandboxed argument in the sortFunc wrapper. An attacker can...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the extract process. An attacker can execute arbitrary PHP code on the server by uploading a ZIP archive containing PHP-executable files and extracting them into a web-accessible directory. This is only...
CVE-2026-66047: Missing Authentication for Critical Function
ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...