113812 matches found
CVE-2026-114624 baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...
CVE-2026-114624 baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
woxeshell ⚠️ Authorized use only. Detection on systems...
EUVD-2026-108993
baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm::execute subsequently applies rawurldecode to fullpath before writin...
CVE-2026-114622 baserCMS: Encoded path traversal bypass in the theme file API
baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm::execute subsequently applies rawurldecode to fullpath before writin...
CVE-2026-114622
The website development framework baserCMS contains an encoded path traversal bypass in the optional BcThemeFile plugin 's Admin API, affecting versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2. The root cause is an incorrect behavior order where ThemeFilesService::update() and getFullpath() val...
CVE-2026-114622 baserCMS: Encoded path traversal bypass in the theme file API
baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm::execute subsequently applies rawurldecode to fullpath before writin...
CVE-2026-114622
baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm::execute subsequently applies rawurldecode to fullpath before writin...
php2shell
php2shell - CVE-2026-109618 & CVE-2026-109619 Testing Environm...
CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...
EUVD-2026-108983
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...
CVE-2026-115481
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, "PermissionGroupsService::build" reads a plugin's "config/permission.php" to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead:...
CVE-2026-115481
The baserCMS website development framework is vulnerable in versions 5.0.0-beta1 up to (but not including) 5.3.2 and 5.4.2 . The root cause lies in PermissionGroupsService::build(), which creates a wildcard allow rule for non-admin groups when a plugin's config/permission.php file is missing. Bec...
CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...
CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...
CVE-2026-112850
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1...
CVE-2026-112848 WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0...
CVE-2026-112848
The AivahThemes Hostme v2 WordPress theme (versions
CVE-2026-112848 WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0...
EUVD-2026-108954
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1...