PT-2026-69355

Name of the Vulnerable Software and Affected Versions Squeeze WordPress plugin versions prior to 1.7.12 Description Insufficient validation of file types or extensions during attachment-update actions allows users with the upload files capability, such as those with Author privileges and above, t...

Alibaba Cloud Linux 3 : 0247: php:7.4 (ALINUX3-SA-2026:0247)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0247 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-14355: In PHP versions 8.2. before 8.2.32,...

PT-2026-69476

Name of the Vulnerable Software and Affected Versions dulldusk/phpfm versions prior to 1.8.1 Description An unrestricted file upload issue allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application is configured by default with an empty upload extension...

Sneeit Framework Code Execution

The vulnerability of the sneeitarticlespaginationcallback function in the Sneeit Framework, a content management system for WordPress, is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

WavePlayer Plugin Arbitrary File Upload Code Execution

The vulnerability of the waveplayercreatelocalcopy function in the WordPress content management system’s plugin, WavePlayer, allows for unlimited loading of malicious files. Exploiting this vulnerability enables a remote attacker to load arbitrary files and execute arbitrary code by loading a...

acfe_module_form_front.render Plugin Code Execution

Vulnerability of the prepareform function in the acfemoduleformfront.render method of the Advanced Custom Fields plugin: This vulnerability is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

WPBookit Image Upload Code Execution

The vulnerability of the imageUploadHandle function in the WPBookit plugin of the WordPress content management system involves unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-72592: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

PT-2026-69941

Name of the Vulnerable Software and Affected Versions Cachet versions prior to 2.4.2 Description An issue exists in incident template rendering that allows authenticated users to perform server-side template injection. By creating malicious incident templates using Blade directives or Twig filter...

CVE-2026-69118: Improper Neutralization of Special Elements Used in a Template Engine

Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...

Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

Exploit Title: Joomla 2.9.99.4 -Unauthenticated Remote Code Execution Date: 2026-07-10 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.joomla.org/ Software Link: https://extensions.joomla.org/extension/jce/ Version: JCE 1.0.0 through 2.9.99.4 fixed in 2.9.99.5 Tested on: Jooml...

CVE-2026-19378 code-projects Task Management System CommentSave.php cross site scripting

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...

CVE-2026-19364

The CVE concerns itsourcecode Hospital Management System 1.0. The vulnerability is in an unknown function in /viewdoctorconsultancycharge.php where manipulating the delid argument leads to SQL injection. Attacks can be performed remotely, and public disclosure of the exploit is noted. The connect...

CVE-2026-19344 code-projects Task Management System comment_count_user.php sql injection

A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/commentcountuser.php. The manipulation of the argument taskid leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-18465 WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

EUVD-2026-54879

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

PT-2026-69275

Name of the Vulnerable Software and Affected Versions WP MAPS PRO versions prior to 6.1.3 Description An issue exists where a capability check is missing in an AJAX action available to unauthenticated users. The plugin fails to properly validate a user-controlled path used in a file inclusion...

Kitty PHP HTTP Polling Drop-in

Writes a PHP script that polls listeners/multi/reversehttppolling. Deploy on a web host and trigger via cron, include, or HTTP request. from kittysploit import from lib.c2.agentinstaller import buildphppollingdropin from lib.c2.beaconprofile import BeaconProfile class ModuleBackdoor: """PHP drop-...

CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...

CVE-2026-16267: Deserialization of Untrusted Data

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...