4748 matches found
CVE-2026-107806: Improper Control of Generation of Code
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...
CVE-2026-108258: Improper Limitation of a Pathname to a Restricted Directory
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
PT-2026-108935
Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.3.8 through 2.4.x Description An authenticated administrator with an active secure session can achieve remote code execution by exploiting the backup restore flow. By submitting attacker-controlled portable backup key...
PT-2026-108964
Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description An authenticated user with permissions to create and restore backups can perform an arbitrary file write. The issue occurs because the internal/backup/restore.go file extracts inner archives...
PT-2026-109313
Name of the Vulnerable Software and Affected Versions Shiny for Python versions 1.4.0 through 1.6.3 Description The bookmark restore process accepts a client-supplied state id query-string value and joins it into the server-side bookmark directory without proper validation. An unauthenticated...
CVE-2026-25589-25588-25243-23631-23479-REDIS
GUIDE TO CHECKING & REMEDIATING 5 REDIS CVEs AS OF 2026.05.08 Release date: 2026-05-08 Author: TonyCao [email protected] Source: Redis Security Advisory TABLE OF CONTENTS 1. Overview 2. Affected Versions 3. Details of Each CVE CVE-2026-23479 — Use-after-free in Unblock Client Flow...
postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump
A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...
CVE-2026-86826
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...
CVE-2026-86828
The BackWPup WordPress plugin (versions prior to 5.7.7 ) is vulnerable to a path traversal flaw during the backup restore process. When the plugin's fallback archive library is utilized, it fails to properly restrict the destination path of extracted files. This allows high-privileged users to wr...
CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...
EUVD-2026-94749
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...
CVE-2026-86826
The BackWPup WordPress plugin, in versions before 5.7.7 , fails to properly restrict web access to the working directory utilized during backup restores. On webservers that do not honor .htaccess rules, such as NGINX , unauthenticated attackers can download full backup archives left behind by int...
EUVD-2026-94646
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...
PT-2026-107843
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...
WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SiteVault – Backup, Restore, Migration & Cloning versions = 1.5.19...
WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Web Plura Backup & Restore Manager versions = 0.2.25...
CVE-2026-41559
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...
CVE-2026-105071
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning = 1.5.17 versions...