111904 matches found
Exploit for CVE-2026-17543
PHP CVE-2026-17543 Exposure Validator Safe network-side valid...
php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD
A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...
WordPress ElementsKit Elementor Addons plugin < 3.10.01 - Subsite Administrator+ PHP Code Injection vulnerability
Subsite Administrator+ PHP Code Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ElementsKit Elementor addons Lite versions 3.10.01...
CVE-2026-16618
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
WordPress Kirki plugin < 6.0.13 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Hermanhms in WordPress Plugin Kirki versions 6.0.13...
CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
CVE-2026-16623
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
EUVD-2026-52579
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
Exploit for Incorrect Default Permissions in Samsung Android
--- CVE-2026-21015 – PHP Filter Chain Arbitrary File Read...
php8.4 security, bug fix, and enhancement update
8.4.23-1 - rebase to 8.4.23...
CVE-2026-18766: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php. Executing a manipulation of the argument filtercol can lead to sql...
PT-2026-67667
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
PT-2026-74931
TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p2+tuxcare...
PT-2026-76395
This update brings the latest version of php 8.2 and fixes some security vulnerabilities...
Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2026-013 (ALASPHP8.2-2026-013)
The version of php installed on the remote host is prior to 8.2.33-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2026-013 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions...
Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-2044)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2044 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...
Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-2042)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2042 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...
Amazon Linux 2 : vim, --advisory ALAS2-2026-3829 (ALAS-2026-3829)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3829 advisory. Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents ...