CVE-2026-112302

A flaw was found in kiwilan php-archive. The ZIP archive extraction process fails to properly validate destination file paths, leading to a path traversal vulnerability. A remote attacker can provide a specially crafted ZIP archive containing directory traversal sequences to exploit this flaw...

LotusCMS 3.0 - Remote Code Execution

LotusCMS 3.0 is susceptible to remote code execution via the Router function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call and allow remote code execution. id: CVE-2011-0518 info: name: LotusCMS 3.0 - Remote Code Execution author: pikpikcu...

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

PHP-Fusion 9.03.50 - Remote Code Execution

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. id: CVE-2020-24949 info: name: PHP-Fusion 9.03.50 - Remote Code Execution author: geeknik severity: high description: PHP-Fusion 9.03.50...

WordPress UserPro 4.9.32 - Cross-Site Scripting

WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API v2 it relies on allows it via the example/success.php errordescription parameter. id: CVE-2019-14470 info: name: WordPress UserPro 4.9.32 - Cross-Site Scripting author: daffainfo severity: mediu...

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

HuangDou UTCMS V9 - OS Command Injection

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell Guard Scanner kerentanan PHP2Shell — CVE-20...

UBUNTU-CVE-2026-123125

The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery SSRF in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...

CVE-2026-123490: craftcms cms: Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller…

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account ...

CVE-2026-104010: creativewerkdesigns WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database: The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable…

The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field e.g., your-message' parameter parameter. This is due to insufficient...

CVE-2026-123792: sensiolabs symfony: The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted…

The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in Symfony versions prior to 5.4.56, 6.x...

Door404

Door404 Door404 is Open Source Project Developed ByMrSqar & Rizer This Project Developed For 2 Reasons First " Help Beginners to learn coding . " Second " Help Newbie Servers Managers To Learn New Protection Tricks " Requirements PHP PHP CUrl OS Linux Screen Shots Video : License DWTFPL DO WHAT T...

CVE-2024-4577-PHP-CGI-RCE

This is a YAML file written specifically for the php-CGI RCE vulnerability - High Risk Introduction php-CGI is an interface used by web servers to run PHP scripts. It connects the PHP interpreter to the web server through CGI Common Gateway Interface. Vulnerability Cause PHP ignored the Best-Fit...

CVE-2026-88023

A flaw was found in the GridFS component of the MongoDB PHP Library. This vulnerability allows an authenticated user to inject special elements into file identifiers, causing them to be interpreted as query conditions. This can lead to unauthorized access to stored file content, the deletion of a...

CVE-2026-50275

A flaw was found in Datadog PHP Tracer. Improper parsing of W3C baggage HTTP headers allows a remote unauthenticated client to send an arbitrarily large number of key-value pairs or an oversized value. This causes the tracer to consume unbounded CPU and memory on each request, leading to a Denial...

CVE-2026-100358

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdownname through htmlentitydecode and writes the result verbatim into a PHP language file under custom/ that is included on...

CVE-2026-100358

Prior to versions 7.15.2 and 8.10.2 , SuiteCRM is vulnerable to a PHP injection flaw in the Studio Dropdown Editor . The application passes the $dropdown_name variable through html_entity_decode() and writes the result directly into a PHP language file within the custom/ directory. This allows an...