762 matches found
CVE-2026-120514
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpmprofilepicture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-120514 Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpmprofilepicture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-120514
The Zephyr Project Manager plugin for WordPress (versions up to and including 3.3.209 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'zpm_profile_picture' parameter. This flaw stems from insufficient input sanitization and output escaping . An authenticated attacker with subscriber-...
EUVD-2026-119030
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpmprofilepicture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Zephyr Project Manager plugin <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zecke in WordPress Plugin Zephyr Project Manager versions = 3.3.209...
CVE-2024-6536
Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u user -p user -...
Exploit for CVE-2026-116512
CVE-2026-116512 - Project Manager RCE Cyp1337 Edition !Pyt...
RISE-Ultimate_Project_Manager_e_CRM
CVE-2025-3855 - RISE Ultimate Project Manager - IDOR Security vulnerability: IDOR Insecure Direct Object Reference Affected Component: profile image upload endpoint, teammembers controller Software: RISE - Ultimate Project Manager & CRM Vendor: codecanyon Version: 3.8.2 CVE ORG :...
CVE-2026-116512
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated...
CVE-2026-26211
-orange?style=for-the-badge&logo=owasp CVE-2026-26211: Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0 Vulnerability: Stored Cross-Site Scripting XSS CWE: CWE-79 Researcher: LINDAN TRI SAPUTRA Initial Report: August 1, 2026 Summary A stored Cross-Site...
CVE-2026-116512
The Project Manager WordPress plugin (versions up to and including 4.1.1 ) is vulnerable to Remote Code Execution (RCE) . The root cause is the unsanitized id parameter being concatenated directly into a pipe-delimited validation rule string, which is then split and each token is executed as a dy...
CVE-2026-116512 Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated...
CVE-2026-116512 Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated...
EUVD-2026-114653
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated...
CVE-2026-116512: wedevs: The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress…
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated...
WordPress Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin <= 4.1.1 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin WP Project Manager versions = 4.1.1...
PT-2026-134475
Name of the Vulnerable Software and Affected Versions Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker versions prior to 4.1.2 Description Unauthenticated attackers can achieve remote code execution on the server. The issue occurs because the id...
VulnCheck KEV: CVE-2026-116512
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated...
CVE-2026-104843
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...