CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18328

The Forminator Forms WordPress plugin (all versions up to and including 1.57.0 ) is vulnerable to DOM-Based Reflected Cross-Site Scripting via the error_description parameter, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

Exploit for OS Command Injection in Totolink N600R_Firmware

CVE-2022-28906 PoC Python proof of concept for unauthenticate...

CVE-2026-78470

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

PHPUnit-GoScan

🛡️ PHPUnit Go Scanner CVE-2017-9841 Ein schneller, in Go geschriebener Multithread-Scanner zur Erkennung exponierter und verwundbarer eval-stdin.php-Endpunkte in PHPUnit CVE-2017-9841. Unterstützt das Scannen mehrerer Domains mit paralleler Ausführung und automatischer Protokollerkennung. 🖼...

XStream 1.4.18 - Remote Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

vBulletin 5.0.0-5.5.4 - Remote Command Execution

vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widgetphp routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system...

Zyxel NAS Firmware 5.21- Remote Code Execution

Multiple Zyxel network-attached storage NAS devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using th...

ThinkPHP < 3.2.4 - Remote Code Execution

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via the s parameter in index.php through the invokefunction functionality. id: CVE-2019-9082 info: name: ThinkPHP 3.2.4 - Remote Code Execution author: 0xanis severity: high description: |...

Craft CMS - Remote Code Execution via Template Path Manipulation

This template identifies a critical Remote Code Execution RCE vulnerability in Craft CMS, identified as GHSA-2p6p-9rc9-62j9. The vulnerability exists due to improper handling of the --templatesPath query parameter, allowing attackers to execute arbitrary code by referencing malicious Twig...

Dasan GPON Devices - Remote Code Execution

Dasan GPON home routers are susceptible to command injection which can occur via the desthost parameter in a diagaction=ping request to a GponForm/diagForm URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to...

Zoneminder

ADVISORY SUMMARY Successful exploitation of this vulnerability could result in full Remote Code Execution RCE as the web server user. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78470

WP Project Manager Pro is a WordPress plugin vulnerable to SQL Injection in all versions up to and including 4.0.1 . The root cause is insufficient escaping on a user-supplied parameter combined with a lack of prepared statements in the existing SQL query. An authenticated attacker with Subscribe...

EUVD-2026-65299

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

Server-side Request Forgery (SSRF)

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the server parameter in the login form's validator. An attacker can establish unauthorized TCP connections to internal hosts and ports by...

External Control of File Name or Path

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to External Control of File Name or Path via the ns parameter in plugins/sql-log.php. An attacker can write arbitrary .sql files with attacker-controlled content to any writable...

Directory Traversal

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Directory Traversal via the db parameter in SQLite mode when the database-list drop action does not validate file extensions before deletion. An attacker can delete arbitrary file...