113748 matches found
CVE-2026-123792 Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in Symfony versions prior to 5.4.56, 6.x...
EUVD-2026-118309
The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in Symfony versions prior to 5.4.56, 6.x...
CVE-2026-123490
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account ...
Prestashop-CVE-2024-34716
Exploit Script for CSRF and Reverse Shell Attack This script automates a CSRF Cross-Site Request Forgery exploit to upload a PHP reverse shell on a target's web server and execute it. The reverse shell is delivered as a ZIP file via a crafted CSRF payload, which is triggered when a privileged use...
BlackThrone
BlackThrone PHP BlackThrone Script An open source Alternative to burp collaborator BlackThrone created To detect websockets and HTTP traffic in the main website with provide some server header and client info. BlackThrone is web based tool to run on webservers with PHP . It will detect the visito...
CVE-2026-104010
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field e.g., your-message' parameter parameter. This is due to insufficient...
EUVD-2026-118195
The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acfamemlocaluserpassword parameter of the advanced-members-account-password shortcode form submission. This is due to a PHP operator-precedence bug in the...
EUVD-2026-118191
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field e.g., your-message' parameter parameter. This is due to insufficient...
CVE-2026-104010
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database WordPress plugin is vulnerable to Remote Code Execution (RCE) in versions up to and including 1.8.0 . The root cause is the insufficient sanitization of Contact Form 7 (CF7) submission fields before database stor...
CVE-2026-104010 WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field e.g., your-message' parameter parameter. This is due to insufficient...
EUVD-2026-118171
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wpunslash is...
CVE-2026-87964
The Product Feed Manager for WooCommerce – CTX Feed WordPress plugin (versions
CVE-2026-118423
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution...
CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20...
CVE-2026-119516
The Radius Booking — Booking Calendar for Appointments & Services plugin (by Mamunur Rashid) is vulnerable to PHP Object Injection via the deserialization of untrusted data . This issue affects versions up to and including 1.0.20 . An attacker could potentially exploit this flaw to execute arbitr...
CVE-2026-118423
The WP Libre Form WordPress plugin version 1.5.0.1 is vulnerable to remote code execution (RCE) . The root cause is a failure to validate file types during form submissions, which allows unauthenticated attackers to upload PHP files to a web-accessible directory. Once uploaded, these files can be...
CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution...
WordPress WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability
Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by GivMeInJ in WordPress Plugin Save Contact Form 7 data to Google Spreadsheet versions = 1.8.0...
WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection vulnerability
Authenticated Shop Manager+ PHP Code Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin CTX Feed versions = 8.0.26...
