CVE-2026-16443

creationtimestamp| type| source ---|---|--- 2026-08-05 14:20:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jb5m44hrlhlib 2026-08-06 13:10:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msg4hotxsw2a...

CVE-2026-15979

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

Malicious code in shift-sdk-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aca555e012d36b30d9ffe3d0f8acdca7ba67298a87ea02ea9d32731e8f2a748 [email protected] registers a postinstall script that runs dist/recon.js on npm install. The script collects hostname, username, SUDOUSER, home...

Malicious code in viem-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32 The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey...

Malicious code in tracker-radar-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1 package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, D...

CVE-2026-71238

creationtimestamp| type| source ---|---|--- 2026-08-05 11:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgn2laot2o...

CVE-2026-71237

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $POST'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='$username' and password='$password' limit 1". The username value is...

CVE-2026-60009

In Eclipse Theia up to 1.73.1, the backend @theia/filesystem binds POST /file-upload in every filesystem-enabled deployment. The handler uses an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no au...

CVE-2026-71249 299Ko: Unauthenticated Reflected XSS in Public Contact Form

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249

CVE-2026-71249 affects 299Ko’s public contact form. The vulnerability arises in the plugin/contact/controllers/ContactController.php (home()) where raw POST fields (name, firstname, email, message) are inserted into the page template without sanitization. The template engine’s _show_var() echoes ...

EUVD-2026-53310

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $POST'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='$username' and password='$password' limit 1". The username value is...

CVE-2026-71213

creationtimestamp| type| source ---|---|--- 2026-08-05 09:24:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msd7el3ddz2z 2026-08-05 10:04:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/27z3zm2wyka4w...

CVE-2026-7105

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2026-71207

The Stock-Inventory-Management-System application's login.php assigns raw $POST username/password values to $SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can...

CVE-2026-4431

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

CVE-2026-11977

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

EUVD-2026-53288

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

CVE-2026-11977

The affected software is the WordPress plugin WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars . The vulnerability is a generic SQL Injection via the parameter wpma_metabox_authors_list in all versions up to and including 3.9.1, caused by insufficient escaping and lac...