CVE-2026-11613

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'customlooptemplate' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing th...

CVE-2026-11613 Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'customlooptemplate' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing th...

EUVD-2026-70888

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'customlooptemplate' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing th...

Flextype CMS 1.0.0-alpha.3 Remote Code Execution

Flextype CMS version 1.0.0-alpha.3 contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes. The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content...

DEBIAN-CVE-2026-76174

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

EUVD-2026-70368

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-77009

CVE-2026-77009 affects the WatchMan-Site7 WordPress plugin through version 4.2.0 . The plugin fails to restrict access to its debugging console , which executes user-supplied PHP code . Any authenticated user with a low privilege level (e.g., a subscriber ) can leverage this to achieve remote cod...

Arbitrary Code Injection

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Arbitrary Code Injection via the VACUUM INTO process in SQLite query handling. An attacker can execute arbitrary code on the server by crafting a query that writes PHP code to...

CVE-2026-34741: Missing Authentication for Critical Function

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

EUVD-2026-63199

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

GHSA-PCW8-M77R-2528 jmespath.php has CompilerRuntime code injection via unescaped function names

Impact mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the errorlog function. An attacker can write arbitrary PHP code to web-accessible files by leveraging access to...

CVE-2026-17533

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...