111330 matches found
CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
cve-analysis-exploitation-mitigation
CVE Analysis, Exploitation & Mitigation A hands-on cybersecur...
EUVD-2026-67044
opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...
CVE-2026-40526
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
CVE-2026-40526
Volmarg Personal Management System contains a path traversal vulnerability in the GET /public/get-file/{path} endpoint. The path parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, allowing an authenticated attacker to read arbitrary fi...
CVE-2026-40526 Volmarg Personal Management System Path Traversal via get-file Endpoint
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
CVE-2026-40526 Volmarg Personal Management System Path Traversal via get-file Endpoint
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
CVE-2018-16370
creationtimestamp| type| source ---|---|--- 2026-08-27 12:00:11+00:00| seen| Telegram/SVZvTdeqqmSRakJEIQhn4CjyThzPklzbZgbnjRRXOSeUVHM 2026-08-28 00:00:55+00:00| seen| Telegram/SVZvTdeqqmSRakJEIQhn4CjyThzPklzbZgbnjRRXOSeUVHM 2026-08-29 00:00:15+00:00| published-proof-of-concept|...
CVE-2026-78286
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78292
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78257
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
EUVD-2026-66946
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78292
CVE-2026-78292 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Hash Form , affecting versions
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78286
CVE-2026-78286 affects the WordPress Geo Controller plugin in versions ≤ 8.9.8 . The vulnerability is an unauthenticated PHP Object Injection , meaning an attacker can trigger it over the network without any credentials or user interaction. The CNA (Patchstack) assigned a CVSS 3.1 score of 9.8 (C...
CVE-2026-78286 WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...