110380 matches found
CVE-2026-4357
The Embed HTML5 Game WordPress plugin (through version 1.3 ) fails to properly restrict both who can upload files and what file types are permitted via the plugin. This allows unauthenticated attackers to upload PHP backdoors on affected sites, potentially leading to full compromise. The vulnerab...
CVE-2026-4357 Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...
EUVD-2026-70038
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...
CVE-2026-10821
Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...
php: ext-pgsql: PHP: SQL injection via improper backslash escaping
A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...
php: PHP: Denial of Service via circular symbolic links in phar archives
A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...
Important: Red Hat Security Advisory: php security, bug fix, and enhancement update
An update for php is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
CVE-2026-81772
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...
CVE-2026-81283
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
EUVD-2026-69930
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...
CVE-2026-81772 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...
CVE-2026-81772 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...
CVE-2026-81772
CVE-2026-81772 affects the Ninja Forms – Layout & Styles WordPress plugin in versions ≤ 3.0.31 . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 3.1 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that a remote, unauthenticated attacker requiri...
CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
EUVD-2026-69922
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2026-81283
WP User Frontend is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 4.3.10 and below . The vulnerability requires low privileges (subscriber-level access), no user interaction, and a low attack complexity, making it accessible to any authenticated subscriber on a s...
CLSA-2026-1788348158 TuxCare security update for firebase/php-jwt (1 CVE)
TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in v5.5.1-p1+tuxcare...
