Lucene search
+L

19559 matches found

CVE
CVE
added 2026/08/26 5:50 p.m.28 views

CVE-2026-32639

Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...

6.8CVSS5.5AI score0.00279EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/26 5:50 p.m.6 views

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

6.8CVSS5.7AI score
SaveExploits0References6
Patchstack
Patchstack
added 2026/08/26 7:45 a.m.8 views

WordPress Avada Theme <= 7.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Theme Avada versions = 7.16...

9.8CVSS5.5AI score0.00638EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/08/26 7:42 a.m.6 views

EUVD-2026-66334

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

6.4CVSS5.5AI score0.00349EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/26 7:42 a.m.33 views

CVE-2026-6178 Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

6.4CVSS0.00349EPSS
SaveExploits0References8
CVE
CVE
added 2026/08/26 7:42 a.m.19 views

CVE-2026-6178

The Betheme WordPress theme (all versions up to and including 28.4 ) is vulnerable to stored cross-site scripting via the 'icon_box_2' shortcode. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, allowing any authenticated user with contributor-lev...

6.4CVSS5.5AI score0.00349EPSS
SaveExploits0References8
NVD
NVD
added 2026/08/26 7:16 a.m.6 views

CVE-2026-18431

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

9.8CVSS0.00638EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/26 6:08 a.m.92 views

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

9.8CVSS0.00638EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/26 6:08 a.m.18 views

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

9.8CVSS6.7AI score0.00638EPSS
SaveExploits0References2
Wordfence Blog
Wordfence Blog
added 2026/08/25 6:02 p.m.13 views

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

A year ago we wrote that we'd put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted...

9.8CVSS7.7AI score0.00638EPSS
SaveExploits0
NVD
NVD
added 2026/08/25 4:17 p.m.8 views

CVE-2026-79773

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

6.9CVSS0.00385EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/25 3:16 p.m.9 views

EUVD-2026-65531

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

6.9CVSS5.3AI score0.00385EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/08/25 3:16 p.m.7 views

CVE-2026-79773 Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

6.9CVSS5.3AI score0.00385EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/25 3:16 p.m.16 views

CVE-2026-79773

Winter CMS before 1.2.13 is affected by a local file inclusion vulnerability in the JavascriptImporter filter . Authenticated users holding the cms.manage_assets permission can embed =include or =require directives in theme JavaScript assets, referencing files outside the theme directory (e.g., ....

6.9CVSS5.3AI score0.00385EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/25 3:16 p.m.32 views

CVE-2026-79773 Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

6.9CVSS0.00385EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/25 9:17 a.m.11 views

CVE-2026-78566

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

8.1CVSS0.00477EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/25 8:28 a.m.35 views

CVE-2026-78566 Shuffle <= 1.8 - Unauthenticated Local File Inclusion

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

8.1CVSS0.00477EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/25 8:28 a.m.7 views

EUVD-2026-65326

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

8.1CVSS6.3AI score0.00477EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/25 8:28 a.m.14 views

CVE-2026-78566

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.8 . An unauthenticated attacker over the network can include and execute arbitrary files on the server, enabling execution of any PHP code contained in those files. This may be used to bypa...

8.1CVSS6.3AI score0.00477EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/25 7:25 a.m.5 views

Blackash-CVE-2025-4322

CVE-2025-4322 : Escalation dei Privilegi non Autenticata tramite Aggiornamento Password "Account Takeover 🔥" Descrizione : Il tema Motors per WordPress è vulnerabile all'escalation dei privilegi tramite account takeover in tutte le versioni fino alla 5.6.67 inclusa. Ciò è dovuto al fatto che il...

9.8CVSS9.2AI score0.15647EPSS
SaveExploits3
Rows per page
Query Builder