CVE-2026-79362

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

CVE-2026-79362

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

EUVD-2026-76188

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

CVE-2026-79362

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source

TL;DR:CVE-2026-75650 , dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. Adobe assigned the...

SPIP Autosave Session Unauthenticated Remote Code Execution

This Metasploit module exploits an unauthenticated RCE in SPIP less than or equal to 4.4.21 via the forum autosave session handler. The action=session endpoint allows any visitor to store arbitrary data in a PHP session variable. By writing PHP code into an autosaveforum session key, the code is...

CVE-2026-78625

Okta Access Gateway is affected by an insufficient validation vulnerability in its dashboard site configuration . The product fails to sanitize dashboard application label values before writing them into generated PHP configuration files . Since the generated file is automatically included during...

CVE-2026-55634

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...

Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Overview A DataObject class-definition field name is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class protected $;. A user holding only the ordinary objects DataObjects permission can import a class definition whose field...

CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...

CVE-2026-45117 MyBB: Installer database configuration RCE

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

CVE-2026-73367

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

EUVD-2026-61091

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

PT-2026-67455

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

CVE-2026-16610

CVE-2026-16610 , for the Admin and Site Enhancements (ASE) Pro WordPress plugin, is documented as allowing unauthenticated remote code execution in all versions up to 8.9.0 via the recursive_html function. The root cause is a vulnerable frontend save handler that relies on a publicly emitted nonc...

EUVD-2017-18977

WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint...

PT-2026-83255

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.19 Pimcore versions prior to 12.3.10 Pimcore versions prior to 2026.1.6 Description An authenticated user with objects permission can achieve remote code execution RCE and perform SQL injection via the...

EUVD-2018-21879

Dolibarr ERP CRM 7.0.3 contains a remote code evaluation vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the dbname parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the dbname parameter, then...

CVE-2018-25357 Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the dbname parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the dbname parameter, then...