10100 matches found
CVE-2026-87964
The Product Feed Manager for WooCommerce – CTX Feed WordPress plugin (versions
WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection vulnerability
Authenticated Shop Manager+ PHP Code Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin CTX Feed versions = 8.0.26...
CVE-2026-73695 Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject...
CVE-2026-102802
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
CVE-2026-102802 Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
EUVD-2026-115181
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
CVE-2026-102802 Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
CVE-2026-102802
The Sourcerer extension (< 17.0.1) and the Articles Anywhere extension (
CVE-2026-102802: regularlabs.com: Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles…
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
PT-2026-135483
Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 1.16 Description A path traversal issue exists in the services/users/index.php endpoint. This occurs because the module name parameter is not properly sanitized before being concatenated into an include path...
CVE-2026-73695: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in…
Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject...
PT-2026-134517
Name of the Vulnerable Software and Affected Versions Articles Anywhere versions prior to 20.1.1 Sourcerer versions prior to 17.0.1 Description A security issue exists that requires a coordinated update across two different components to be fully resolved. Updating only one of the affected...
PT-2026-134516
Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a user or email /...
CVE-2026-44344
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...
CVE-2026-44344
The Chamilo LMS learning management system is vulnerable to arbitrary PHP code execution in versions 1.x before 1.11.40 and 2.x before 2.0.1 . The root cause is the use of eval() calls within the vendored PEAR HTML_QuickForm libraries, which can be triggered if form element names contain attacker...
CVE-2026-44344
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple "eval" calls in the vendored PEAR "HTMLQuickForm" libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo for...
EUVD-2026-113999
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...
PT-2026-133603
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTML QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms...
CVE-2026-44344: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...
VulnCheck KEV: CVE-2019-9041
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzztemplate.php file, the parserIfLabel function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring...