CVE-2026-116211

YesWiki versions 4.5.0 before 4.7.0 are vulnerable to an SQL injection vulnerability within the PageManager::save() function. The issue occurs because the date_maj_fiche field from a Bazar entry-creation request is concatenated unescaped into an INSERT statement. This allows unauthenticated attac...

CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save, where the datemajfiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wikiusers to...

CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save, where the datemajfiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wikiusers to...

KodCloud KodExplorer permission and access control issue vulnerability

KodCloud KodExplorer versions 4.55 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ‘path’ parameter in the file app/controller/editor.class.php within the Online Editor Save Endpoint component. As a result, unrestricted file uploads are possibl...

PT-2026-123055

A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It i...

PT-2026-123050

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save, where the date maj fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki users to...

YesWiki SQL injection vulnerability

Versions prior to 4.7.0 of YesWiki contain an SQL injection vulnerability. This flaw arises because the datemajfiche field in Bazar entry creation requests within PageManager::save is concatenated into the INSERT statement without proper escaping. As a result, it is susceptible to SQL injection...

CVE-2026-112846

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14...

EUVD-2026-108951

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14...

CVE-2026-112846 WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14...

CVE-2026-112846

The Save Life WordPress theme by ThemeREX Group (versions $\le$ 1.2.14 ) is vulnerable to a PHP Object Injection flaw. This issue stems from the Deserialization of Untrusted Data , which allows an attacker to inject objects into the application. The vulnerability results in a CRITICAL severity im...

CVE-2026-112846 WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14...

ThemeREX Save Life deserialization injection vulnerability

ThemeREX Save Life versions 1.2.14 and earlier contain a deserialization injection vulnerability. This vulnerability arises from deserializing untrusted data, potentially leading to object injection...

SUSE CVE-2026-98706

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Save Life versions = 1.2.14...

PT-2026-122066

Name of the Vulnerable Software and Affected Versions Save Life versions prior to 1.2.15 Description Save Life is subject to PHP Object Injection due to the deserialization of untrusted data. This allows unauthenticated attackers to inject a PHP Object. While no native POP chain a sequence of...

PT-2026-120714

A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save files of the file admin class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack...

PT-2026-120667

A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save user of the file admin class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id...

OpenCATS Authorization Issue Vulnerability

Versions of OpenCATS prior to 0.10.0 have an authorization issue vulnerability. This vulnerability stems from the lack of authorization checks. Users with READ privileges can create, rename, delete, and populate save lists through AJAX endpoints. Authorized attackers can send requests with...

CVE-2026-112095

A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/productshandler.php?action=save of the component Product Management. Executing a manipulation of the argument ProductId/ProductName can lead to cross site scripting. The attack may be...