EUVD-2026-52393

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

Public Google API keys can be used to expose Gemini AI data

Google Maps/Cloud API Application Programming Interface keys that used to be safe to publish can now, in many cases, be used as real Gemini AI credentials. This means that any key sitting in public JavaScript or application code may now let attackers connect to Gemini through its API, access data...

PT-2026-1586

Name of the Vulnerable Software and Affected Versions ShareThis Dashboard for Google Analytics plugin for WordPress versions through 3.2.4 Description The plugin is susceptible to Sensitive Information Exposure. The Google Analytics client ID and client secret are stored in plaintext within the...

EUVD-2025-180319

Malicious code in array-public-code-async-decompress npm...

Malicious code in cold-short-phi-public-code (npm)

The package cold-short-phi-public-code was found to contain malicious code...

MAL-2025-17278 Malicious code in cold-short-phi-public-code (npm)

The package cold-short-phi-public-code was found to contain malicious code...

CVE-2023-36817 The King's Temple Church website Leaked Stripe API Key in Public Code Repository

tktchurch/website contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized...

PT-2011-4696

Name of the Vulnerable Software and Affected Versions TCExam version 11.1.015 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing certain files, such as public/code/tce page footer.php, which reveals the...

CVE-2009-4747: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in public/code/cphtml2xhtmlbasic.php in All In One Control Panel AIOCP 1.4.001 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter, a different vector than CVE-2009-3220...

CVE-2008-4782: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in public/code/cppollsresults.php in All In One Control Panel AIOCP 1.4 allows remote attackers to execute arbitrary SQL commands via the pollid parameter...

Drcat 0.5.0-beta (drcatd) Remote Root Exploit

No description provided by source. / Proof of Concept DRCATD Remote exploit by Taif Test: root@localhost drcat ./drcat -d 127.0.0.1 -u taif -p test Public code by Taif drcat-0.5.0-beta 'remote r00t' proof Bug found by Khan Shirani host: +-+-+-+-+-+-+-+ 127.0.0.1 |C|L|U|P|C|S|R| user:...

CVE-2007-3120: Undefined Security Weakness

Cross-site scripting XSS vulnerability in public/code/cpdpage.php in All In One Control Panel AIOCP before 1.3.017 allows remote attackers to inject arbitrary web script or HTML via the aiocpdp parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-2430: Undefined Security Weakness

shared/code/tcetmx.php in TCExam 4.0.011 and earlier allows remote attackers to create arbitrary PHP files in cache/ by placing file contents and directory traversal manipulations into a SessionUserLang cookie to public/code/index.php...

CVE-2006-5832: Undefined Security Weakness

All In One Control Panel AIOCP 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to 1 public/code/cpdpage.php, possibly involving the aiocpdp parameter, 2 public/code/cpshowecproducts.php, possibly involving the orderfield parameter, and 3...