CVE-2024-11613-wp-file-upload

CVE-2024-11613-wp-file-upload Chirag Artani（https://3rag.com）によるCVE-2024-11613（WordPress File Upload）のエクスプロイト 情報はこちら - WordPress用WordPress File...

CVE-2024-10571

CVE-2024-10571 Chartify – WordPress 차트 플러그인 = 2.9.5 - 인증되지 않은 로컬 파일 포함 source 매개변수 설명 WordPress용 Chartify – WordPress 차트 플러그인 플러그인은 'source' 매개변수를 통해 2.9.5를 포함한 모든 버전에서 로컬 파일 포함 취약점에 영향을 받습니다. 이를 통해 인증되지 않은 공격자가 서버에 있는 임의의 파일을 포함 및 실행할 수 있어, 해당 파일의 PHP 코드를 실행할 수 있습니다. 이는 접근 제어를 우회하고 민감한 데이터를 얻거나,...

PT-2026-86592

A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source results in server-side request forgery. The attack can be executed remotely...

CVE-2026-85380

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...

CVE-2026-85380

CVE-2026-85380 affects the UEditor component of light0011 CMS (a GitHub-hosted content management system). The vulnerability resides in the catchimage function within Public/ueditor/php/controller.php , where manipulation of the source[] argument enables Server-Side Request Forgery (SSRF) . The a...

CVE-2026-85380 light0011 cms UEditor controller.php catchimage server-side request forgery

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

PT-2026-60880

Name of the Vulnerable Software and Affected Versions MCMS version 6.1.1 Description A remote attacker can obtain sensitive information by exploiting the source parameter. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

CVE-2026-52203: Exposure of Sensitive Information to an Unauthorized Actor

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

PYSEC-2026-1653 mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...

mlflow Path Traversal vulnerability

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifactlocation' and 'source' parameters, using a local URI with '' instead of '?', an attacker can...

PYSEC-2026-1650 mlflow Path Traversal vulnerability

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifactlocation' and 'source' parameters, using a local URI with '' instead of '?', an attacker can...

WordPress WP Statistics plugin <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'utmsource' Parameter vulnerability discovered by daroo in WordPress Plugin WP Statistics versions = 14.16.4...

CVE-2026-5231 WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmsource' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utmsource value into the...

EUVD-2026-23342

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmsource' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utmsource value into the...

CVE-2026-5231

The WP Statistics plugin for WordPress (affected: all versions up to 14.16.4) is vulnerable to Stored Cross-Site Scripting via the utm_source parameter. The root cause is insufficient input sanitization and output escaping: the referral parser copies the raw utm_source into the source_name field ...