Veille CVE

Lundi 15 juin 2026

47 CVE

Critique 18 Élevée 20 Moyenne 9 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Php php » ✕
  1. CVE-2026-9691 9.8 Critique

    CRM Perks Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms

    Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

  2. CVE-2026-49781 9.8 Critique

    Brainstorm Force OttoKit

    Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

  3. CVE-2026-49770 9.8 Critique

    WP Travel Engine

    Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

  4. CVE-2026-49769 9.8 Critique

    Tomdever wpForo Forum

    Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

  5. CVE-2026-49768 9.8 Critique

    Happyforms

    Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

  6. CVE-2026-49765 9.8 Critique

    CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms

    Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

  7. CVE-2026-49763 9.8 Critique

    CRM Perks Integration for Contact Form 7 HubSpot

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

  8. CVE-2026-49109 9.8 Critique

    crm perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

    Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

  9. CVE-2026-49106 9.8 Critique

    CRM Perks Integration for Contact Form 7 and Constant Contact

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

  10. CVE-2026-49105 9.8 Critique

    CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

    Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  11. CVE-2026-49104 9.8 Critique

    CRM Perks Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

    Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

  12. CVE-2026-49085 9.8 Critique

    CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

    Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  13. CVE-2026-42687 8.1 Élevée

    EventPrime

    Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

  14. CVE-2026-39532 8.8 Élevée

    Stiofan Events Calendar for GeoDirectory

    Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

  15. CVE-2026-39499 7.2 Élevée

    Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce

    Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.

  16. CVE-2026-39498 7.2 Élevée

    Yeeaddons YayMail

    Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.

  17. CVE-2026-39481 7.2 Élevée

    WP Chill Modula Image Gallery

    Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.

  18. CVE-2026-39478 8.8 Élevée

    Eli Scheetz Anti-Malware Security and Brute-Force Firewall

    Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.

  19. CVE-2026-39474 8.8 Élevée

    metaphorcreations Post Duplicator

    Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.

  20. CVE-2026-39472 7.2 Élevée

    WP Overnight WooCommerce PDF Invoices & Packing Slips

    Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.

  21. CVE-2026-39471 7.2 Élevée

    ShortPixel Image Optimizer

    Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

  22. CVE-2026-39434 7.2 Élevée

    WebAppick CTX Feed

    Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

  23. CVE-2026-27053 9.8 Critique

    VideoWhisper.com Broadcast Live Video

    Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

  24. CVE-2026-50869 9.8 Critique

    An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.

  25. CVE-2026-49952 9.1 Critique

    Discuz! X5.0

    Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.

  26. CVE-2026-38329 9.8 Critique

    Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.

  27. CVE-2026-36670 8.8 Élevée

    A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table' GET parameter in alias_management.php.

  28. CVE-2019-25746 7.1 Élevée

    SlicedInvoices Sliced Invoices

    WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.

  29. CVE-2018-25437 7.5 Élevée

    Cherryframework Cherry Framework Themes

    WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.

  30. CVE-2018-25436 9.8 Critique

    Shipster Baggage Freight Shipping Australia

    WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.

  31. CVE-2016-20084 7.2 Élevée

    dwbooster Booking Calendar Contact

    WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.

  32. CVE-2016-20083 5.3 Moyenne

    henrikmelin More Fields

    WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests to the options-general.php endpoint.

  33. CVE-2016-20082 6.2 Moyenne

    Abtest

    WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.

  34. CVE-2016-20081 7.5 Élevée

    Husain HB Audio Gallery Lite

    WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.

  35. CVE-2016-20080 6.2 Moyenne

    Brandfolder

    WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_abspath parameter to read sensitive files like wp-config.php or execute remote code.

  36. CVE-2016-20079 6.2 Moyenne

    jamie Dharma Booking

    WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.

  37. CVE-2016-20078 6.2 Moyenne

    Henrique Dias IMDb Profile Widget

    WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like wp-config.php containing database credentials and configuration data.

  38. CVE-2016-20077 6.2 Moyenne

    KaymeePhotography Photocart Link

    WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.

  39. CVE-2016-20076 7.5 Élevée

    ChrisHurst Simple Backup

    WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.

  40. CVE-2016-20075 8.8 Élevée

    Etoilewebdesign Ultimate Product Catalog

    WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.

  41. CVE-2016-20074 4.3 Moyenne

    leethompson Lazy Content Slider Plugin

    WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs_admin.php to modify plugin configuration parameters like lzcs_color and lzcs_count.

  42. CVE-2016-20073 8.2 Élevée

    mattkaye Answer My Question

    Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.

  43. CVE-2016-20070 6.4 Moyenne

    dwbooster Booking Calendar Contact Form

    WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.

  44. CVE-2016-20068 8.2 Élevée

    dwbooster Booking Calendar Contact Form

    WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.

  45. CVE-2026-5482 9.3 Critique

    Tecrail Responsive FileManager

    Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.  This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

  46. CVE-2026-12207 4.3 Moyenne

    medkey-org medkey

    A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

  47. CVE-2026-12204 7.3 Élevée

    ShopXO

    A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/controller/Crontab.php of the component Scheduled Task Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.