113748 matches found
CVE-2026-102435
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthenticated PHP Object Injection leading to arbitrary file deletion in versions up to and including 3.5.54 . The root cause is insufficient file path validation within the _getObjAttr function. This vulnerability requir...
CVE-2026-102435 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the...
Security update for python-sqlparse
This update for python-sqlparse fixes the following issue: CVE-2026-112307: arbitrary code execution via unescaped PHP output formatting bsc1286096. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...
SUSE-SU-2026:5042-1 Security update for python-sqlparse
This update for python-sqlparse fixes the following issue: - CVE-2026-112307: arbitrary code execution via unescaped PHP output formatting bsc1286096...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-scanner A command-line tool for detecting CVE-2026-...
CVE-2026-73695
Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject...
CVE-2026-73695 Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject...
CVE-2026-73695
Control Web Panel (CWP) versions prior to webpanel_version 1.16 are affected by a path traversal vulnerability located in services/users/index.php. The root cause is the direct concatenation of an unsanitized module name parameter into an include path. Attackers can exploit this by injecting dire...
CVE-2026-103420
Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5...
CVE-2026-102802
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
CVE-2026-105600
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5...
CVE-2026-102802 Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
EUVD-2026-115181
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
CVE-2026-102802 Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...
CVE-2026-102802
The Sourcerer extension (< 17.0.1) and the Articles Anywhere extension (
CVE-2026-103420
The StageIt Joomla extension by php-web-design.com is vulnerable to Cross-Site Request Forgery (CSRF) in versions 1.0-5.7.5 and 6.0-6.3.5 . This vulnerability allows an attacker to perform various actions on behalf of a user. The documents do not provide specific details regarding the root cause,...
EUVD-2026-115179
Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5...
EUVD-2026-115178
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5...
CVE-2026-105600
The Joomla Extension by php-web-design.com is vulnerable to Remote Code Execution (RCE) in the StageIt component. The flaw is caused by improper control of generation of code (CWE-94) when processing setting strings. This vulnerability affects StageIt versions 1.0-5.7.5 and 6.0-6.3.5 . The impact...
CVE-2026-105600 Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5...