110192 matches found
PHP 8.5.x < 8.5.11 Multiple Vulnerabilities
The version of PHP installed on the remote host is prior to 8.5.11. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.11 advisory. - Debian Linux - php8.2 - None php8.4 - None CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766,...
PT-2026-97707
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...
PT-2026-97712
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient validation of a display-style setting allows users with the Contributor role and above to perform Local File Inclusion LFI, which is a technique used to trick a...
CVE-2026-88843: Improper Limitation of a Pathname to a Restricted Directory
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...
The vulnerability of the SNMP protocol implementation in the LibreNMS network monitoring system allows a perpetrator to gain unauthorized access to protected information and perform cross-site attacks.
The vulnerability of the SNMP protocol implementation in the LibreNMS network monitoring system is related to deficiencies in the process of blocking outdated PHP templates. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information and perform...
The vulnerability of the dns_get_record() function in the PHP programming language, which allows a hacker to perform an SSRF attack
The vulnerability of the dnsgetrecord function in the PHP programming language is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...
The vulnerability of the get_page_template() function in the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the getpagetemplate function in the WordPress content management system is related to improper handling of file names for PHP functions like include or require. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-97774
Name of the Vulnerable Software and Affected Versions Visual Composer Website Builder versions prior to 45.16.1 Description The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation. Unauthenticated attacker...
CVE-2026-95603
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
EUVD-2026-85506
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
CVE-2026-95603
The Reycob Product Import Export plugin for WordPress, specifically versions
CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion
A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remo...
CVE-2026-63002
REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...
CVE-2026-62998
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...
Improper Neutralization of Special Elements Used in a Template Engine
Overview solspace/craft-freeform is a flexible and user-friendly form building plugin! Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the rendering of submitted form field values in an isolated Twig context. An attacke...
CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...
CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...
CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...