Veille CVE

Semaine du 15 juin au 21 juin 2026

170 CVE

Critique 41 Élevée 96 Moyenne 31 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Php php » ✕
  1. CVE-2026-56396 8.8 Élevée

    phpMyFAQ

    phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.

  2. CVE-2026-56382 7.2 Élevée

    craftcms cms

    Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.

  3. CVE-2026-12789 4.7 Moyenne

    ILIAS Learning Management System

    A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS/Tracking/classes/class.ilTrQuery.php of the component Learning Progress Tracking. Such manipulation of the argument troup_table_nav leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. This issue was independently identified and fixed internally by the vendor's own security team ahead of this report.

  4. CVE-2026-12776 6.3 Moyenne

    Montodel House-Rental-Management

    A flaw has been found in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. This affects an unknown part of the file /index.php?page=houses. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

  5. CVE-2026-12775 7.3 Élevée

    Montodel House-Rental-Management

    A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

  6. CVE-2026-56346 6.5 Moyenne

    AVideo

    AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.

  7. CVE-2026-56345 8.1 Élevée

    AVideo

    AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload with a filename containing an arbitrary users_id to invoke passwordless User->login() and establish an authenticated session as any user including admin. Attackers can obtain the Meet shared secret through path-traversal vulnerabilities or timing attacks against checkToken.json.php, then POST a crafted file to uploadRecordedVideo.json.php with a filename like '1-anything.mp4' to hijack admin sessions and gain full account takeover.

  8. CVE-2026-56342 6.8 Moyenne

    AVideo

    AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter, which lacks isSSRFSafeURL() validation and accepts requests to private IP ranges and cloud metadata endpoints. Attackers can exploit this by crafting requests to internal services, cloud metadata endpoints like 169.254.169.254, and localhost to retrieve sensitive information including IAM credentials, internal service responses, and network configuration details.

  9. CVE-2026-56341 7.5 Élevée

    AVideo

    AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

  10. CVE-2022-50972 9.8 Critique

    WooCommerce

    WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

  11. CVE-2019-25763 9.8 Critique

    Ultimatebeaver Ultimate Addons for Beaver Builder

    WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and authenticate as that user.

  12. CVE-2026-48939 9.8 Critique Exploitée

    icagenda.com iCagenda extension for Joomla · Joomlic icagenda

    A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

  13. CVE-2026-48908 9.8 Critique Exploitée

    joomshaper.net SP Page Builder extension for Joomla · Ollyo sp page builder

    A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

  14. CVE-2026-12119 6.5 Moyenne

    eemitch Simple File List

    The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that bypass the intended authorization checks in includes/ee-list-ops-bar-process.php.

  15. CVE-2026-11911 7.5 Élevée

    eemitch Simple File List

    The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns true for requests to the admin-ajax.php endpoint.

  16. CVE-2026-9843 8.1 Élevée

    crmperks Database for Contact Form 7, WPforms, Elementor forms

    The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.

  17. CVE-2026-12238 5.3 Moyenne

    wpgmaps WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

    The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create arbitrary records in plugin database tables (maps, markers, circles, polygons, polylines, rectangles, and point labels) by supplying a WPGMZA-namespaced CRUD-backed class name via the phpClass parameter. The namespace validation check (requiring the 'WPGMZA' prefix) does not prevent exploitation because classes such as WPGMZA\Map and WPGMZA\Marker satisfy it while still triggering an INSERT into the corresponding plugin table before the route rejects the request.

  18. CVE-2023-54357 7.5 Élevée

    Artio Joomla! com_booking component · Artio book it\!

    Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.

  19. CVE-2026-49359 6.5 Moyenne

    pontedilana php-weasyprint

    PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

  20. CVE-2026-49286 8.1 Élevée

    pontedilana php-weasyprint

    PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue.

  21. CVE-2019-25762 7.5 Élevée

    Joomboost JoomProject

    Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.

  22. CVE-2019-25761 7.1 Élevée

    Joomboost JoomCRM

    Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal_id parameter. Attackers can send GET requests to index.php with option=com_joomcrm&view=contacts and inject SQL code in the deal_id parameter to extract sensitive database information including table names and schemas.

  23. CVE-2019-25760 5.5 Moyenne

    Joomtech Easy Shop

    Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to com_easyshop, task set to ajax.loadImage, and a base64-encoded file path in the file parameter to retrieve sensitive files like configuration.php and system files.

  24. CVE-2019-25758 8.8 Élevée

    Wdmtech vBizz

    Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.

  25. CVE-2019-25753 8.2 Élevée

    Wdmtech VMap

    Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.

  26. CVE-2019-25752 8.2 Élevée

    Cmsjunkie J-BusinessDirectory

    Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the option=com_jbusinessdirectory&task=categories.getCategories parameters and inject UNION-based SQL statements in the type parameter to extract database information including schema names and sensitive data.

  27. CVE-2026-49260 8.2 Élevée

    pontedilana php-weasyprint

    PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escapeshellarg('/usr/local/bin/weasyprint')` returns `'/usr/local/bin/weasyprint'` with the single-quote characters as part of the string, so `is_executable()` looks for a file whose actual name includes those quotes. That file never exists, the "safe" branch is dead code, and the raw `$binary` string (set via the constructor or `setBinary()`) flows directly into `Symfony\Component\Process\Process::fromShellCommandline()`. Any deployment whose binary path is sourced from configuration, an environment variable, or a per-tenant setting reaches a shell-command-injection sink. The library is documented as a one-to-one substitute for KnpLabs/snappy and inherited the exact pre-fix codepath KnpLabs patched in GHSA-vpr4-p6fq-85jc. PhpWeasyPrint version 2.5.1 contains a patch for the issue.

  28. CVE-2017-20282 8.2 Élevée

    Soft-Php jCart for OpenCart

    Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information.

  29. CVE-2017-20281 8.2 Élevée

    Joomlaboat Extra Search

    Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the establename parameter. Attackers can send GET requests to index.php with the option=com_extrasearch parameter and malicious SQL in the establename field to extract sensitive database information.

  30. CVE-2017-20280 8.2 Élevée

    Myportfolio · Myportfolio myportfolio

    Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Attackers can send GET requests to index.php with malicious pid values in the task=project&view=grid endpoint to extract sensitive database information.

  31. CVE-2017-20279 8.2 Élevée

    Extensions Joomla Payage

    Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the aid parameter. Attackers can send GET requests to index.php with malicious aid values in the make_payment task to extract sensitive database information using boolean-based blind or time-based blind techniques.

  32. CVE-2017-20276 8.2 Élevée

    Simbunch SIMGenealogy

    Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the type parameter. Attackers can send GET requests to index.php with the option=com_simgenealogy, view=latest parameters and inject malicious SQL in the type parameter to extract sensitive database information.

  33. CVE-2017-20275 8.2 Élevée

    Henryschorradt Bridge

    Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_phpbridge&view=phpview parameters and inject SQL code in the id parameter to extract database information including table and column names.

  34. CVE-2017-20274 8.2 Élevée

    King-products LMS King Professional · King-products learning management system king

    Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cp_id parameter. Attackers can send GET requests to index.php with the option=com_lmsking, view=lmsking, layout=learningpath, and task=learningPath parameters to extract sensitive database information.

  35. CVE-2017-20273 8.2 Élevée

    Joomlashowroom Event Registration Pro Calendar · Joomalshowroom event registration pro calendar

    Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_registrationpro&view=category&id parameter containing SQL injection payloads to extract sensitive database information.

  36. CVE-2017-20272 8.2 Élevée

    Faboba Ultimate Property Listing

    Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the sf_selectuser_id parameter. Attackers can send GET requests to index.php with the option=com_upl and view=propertylisting parameters to extract sensitive database information including table names and column structures.

  37. CVE-2017-20271 8.2 Élevée

    Nordmograph StreetGuessr Game

    Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with the option=com_streetguess&view=maps parameters and inject SQL code in the catid parameter to extract sensitive database information including version and database names.

  38. CVE-2017-20270 8.2 Élevée

    Raindropsinfotech Twitch Tv

    Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username and id parameters. Attackers can send GET requests to index.php with option=com_twitchtv and view parameters containing SQL injection payloads to extract sensitive database information including credentials and configuration data.

  39. CVE-2017-20265 7.1 Élevée

    Pulseextensions Flip Wall

    Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_flipwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information.

  40. CVE-2017-20264 7.1 Élevée

    Pulseextensions Sponsor Wall

    Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_sponsorwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information including credentials and configuration data.

  41. CVE-2017-20263 8.2 Élevée

    Focalpointx FocalPoint Pro / Free · Focalpointx focalpoint

    Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_focalpoint, view=location, and a crafted id parameter containing SQL commands to extract sensitive database information.

  42. CVE-2017-20262 8.2 Élevée

    Webkul Ajax Quiz

    Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter. Attackers can send GET requests to index.php with the option=com_ajaxquiz and view=ajaxquiz parameters to extract sensitive database information including table names and column structures.

  43. CVE-2017-20259 8.2 Élevée

    Joomlashack OSDownloads

    Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_osdownloads&view=item&id=[SQL] to extract sensitive database information including credentials and configuration data.

  44. CVE-2017-20258 8.2 Élevée

    Extro RPC · Extro responsive portfolio

    Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_pofos&view=pofo&id=[SQL] to extract sensitive database information.

  45. CVE-2017-20255 8.2 Élevée

    Joombooking JB Visa

    Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the visatype parameter. Attackers can send GET requests to index.php with the option=com_bookpro and view=popup parameters, injecting SQL commands in the visatype parameter to extract sensitive database information including credentials and table contents.

  46. CVE-2017-20254 8.2 Élevée

    Gegabyte User Bench

    Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the userid parameter. Attackers can send GET requests to index.php with the option=com_userbench&view=detail&userid parameter containing SQL injection payloads to extract sensitive database information including credentials and configuration data.

  47. CVE-2017-20252 8.2 Élevée

    nextgeneditor NextGen Editor

    Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the plname parameter. Attackers can send GET requests to index.php with option=com_nge&view=config and inject malicious SQL code in the plname parameter to extract sensitive database information.

  48. CVE-2026-49358 3.0 Faible

    pontedilana php-weasyprint

    PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

  49. CVE-2026-8713 9.1 Critique

    themefusion Avada (Fusion) Builder

    The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate 'delete' cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.

  50. CVE-2026-8118 6.5 Moyenne

    wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor

    The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.

  51. CVE-2026-7515 9.8 Critique

    BetterDocs Pro

    The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

  52. CVE-2026-54414 9.8 Critique

    error311 FileRise

    FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).

  53. CVE-2026-49205 6.5 Moyenne

    thorsten phpMyFAQ

    phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The following APIs are affected: POST /api/v4.0/category (CategoryController::create), POST /api/v4.0/faq (FaqController::create), PUT /api/v4.0/faq (FaqController::update), and POST /api/v4.0/question (QuestionController::create). This issue has been fixed in version 4.1.4.

  54. CVE-2026-40457 2.1 Faible

    LMS

    A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and "netremap.php" modules where unsanitized GET parameters are directly embedded into HTML output. This allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link, provided the required conditions (such as a network defined in the system) are met.

  55. CVE-2026-40455 8.6 Élevée

    LMS

    An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg[]" parameter. The application directly concatenates user-supplied array values into an SQL query using "implode()", allowing authenticated attackers to perform Error-Based SQL injection and extract sensitive database information.

  56. CVE-2026-9815 6.5 Moyenne

    Unknown MagicForm

    The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

  57. CVE-2026-55745 5.4 Moyenne

    Cotonti

    Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.

  58. CVE-2026-55744 8.1 Élevée

    Cotonti

    Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do.

  59. CVE-2026-55742 9.6 Critique

    Cotonti

    Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.

  60. CVE-2026-55741 8.8 Élevée

    Cotonti

    Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).

  61. CVE-2026-12137 6.1 Moyenne

    phppoet SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager

    The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Because the vulnerable plugin_options_page() function is only rendered within the WordPress admin dashboard, successful exploitation requires the targeted victim to be logged in with Shop Manager-level access or higher.

  62. CVE-2026-12136 6.4 Moyenne

    phppoet SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager

    The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysbasics_user_avatar' shortcode in versions up to, and including, 4.3.6. This is due to insufficient input sanitization and output escaping on user supplied attributes (min_height, min_width, max_height, max_width) in the wcmamtx_get_avatar_default() function, which are concatenated unescaped into the get_avatar() extra_attr style attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  63. CVE-2026-9860 8.8 Élevée

    vanyukov Offload, AI & Optimize with Cloudflare Images

    The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cf_images_do_setup AJAX handler, which requires only the upload_files capability (Author+) rather than manage_options before writing to wp-config.php, combined with the absence of single-quote escaping — sanitize_text_field() does not strip single quotes, and filter_input(INPUT_POST) bypasses wp_magic_quotes() slashing — allowing a single quote in the account-id or api-key parameter to break out of the single-quoted PHP string literal in the write_config() define() statement. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. This is possible because the 'cf-images-nonce' nonce required by the AJAX handler is exposed to all Author-level and above users on wp-admin/upload.php via the CFImages JavaScript object, meaning any upload-capable user can satisfy the nonce check and reach the vulnerable wp-config.php write path.

  64. CVE-2026-55740 9.8 Critique

    Nur-Alam39 bus-ticket

    Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context.

  65. CVE-2026-48820 6.3 Moyenne

    cakephp

    CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

  66. CVE-2026-48979 7.5 Élevée

    php-standard-library · php-standard-library/h2

    PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is able to send more DATA bytes than declared, smuggling additional content past application-level size limits and send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1.

  67. CVE-2026-48822 5.8 Moyenne

    Shaarli

    Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown link. The vulnerability originates in the filterProtocols method within BookmarkMarkdownFormatter.php.This method attempts to sanitize Markdown links by filtering dangerous protocols (such as javascript:) before rendering. It uses the following regular expression: (#]\((.*?)\)#is). This regex is designed to detect inline Markdown links, but it fails to detect Markdown reference-style links because reference-style links are resolved by the Markdown parser after preprocessing. The filterProtocols method never inspects the actual URL used in these references and as a result, an attacker can supply a javascript: URI inside a reference definition. This issue has been fixed in version 0.16.2.

  68. CVE-2026-12529 7.3 Élevée

    SourceCodester CET Automated Grading System with AI Predictive Analytics

    A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The manipulation leads to improper access controls. Remote exploitation of the attack is possible.

  69. CVE-2026-11407 7.2 Élevée

    Pimcore GmbH Pimcore CMS/DXP

    Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the custom Twig SecurityPolicy. Attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\Text component to perform arbitrary file reads, execute arbitrary database queries, and potentially achieve remote code execution via PHP object gadget chains, with the pimcore_* function wildcard further broadening the bypass to all Pimcore Twig functions.

  70. CVE-2026-54415 8.1 Élevée

    Azuriom CMS

    Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

  71. CVE-2026-54814 8.1 Élevée

    StylemixThemes Motors

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.

  72. CVE-2026-49108 9.8 Critique

    park_of_ideas Moderno

    Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

  73. CVE-2026-40757 8.1 Élevée

    Mikado-Themes Château

    Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

  74. CVE-2026-40756 8.1 Élevée

    Mikado-Themes Zoya

    Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

  75. CVE-2026-40752 8.1 Élevée

    Select-Themes Manufaktur Solutions

    Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

  76. CVE-2026-40738 8.1 Élevée

    Edge-Themes Eldon

    Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

  77. CVE-2026-40733 8.1 Élevée

    Mikado-Themes ShiftUp

    Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

  78. CVE-2026-39576 8.1 Élevée

    Elated-Themes SingleMalt

    Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

  79. CVE-2026-39560 8.1 Élevée

    Select-Themes Hiroshi

    Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

  80. CVE-2026-39556 8.1 Élevée

    Elated-Themes Konsept

    Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

  81. CVE-2026-39445 8.1 Élevée

    PressLayouts Alukas

    Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

  82. CVE-2026-39442 8.1 Élevée

    PressLayouts PressMart

    Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

  83. CVE-2025-69127 9.8 Critique

    ThemeREX Plumbing

    Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

  84. CVE-2025-69111 9.8 Critique

    ThemeREX Reisen

    Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

  85. CVE-2026-54806 9.8 Critique

    Melapress WP Activity Log

    Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

  86. CVE-2026-54194 9.8 Critique

    ThemeFusion Fusion Builder

    Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

  87. CVE-2026-52706 9.8 Critique

    Jetimpex Inc. JetEngine

    Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

  88. CVE-2026-49107 9.8 Critique

    Thrive Themes Thrive Apprentice

    Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

  89. CVE-2026-49075 9.8 Critique

    Jetimpex Inc. JetEngine

    Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

  90. CVE-2026-42380 9.8 Critique

    jwsthemes AI Lab

    Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

  91. CVE-2026-40761 8.1 Élevée

    Edge-Themes Valeska

    Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

  92. CVE-2026-40760 8.1 Élevée

    Edge-Themes Behold

    Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

  93. CVE-2026-40759 8.1 Élevée

    Mikado-Themes Esmée

    Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

  94. CVE-2026-40758 8.1 Élevée

    Elated-Themes Léonie

    Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

  95. CVE-2026-40755 8.1 Élevée

    Mikado-Themes TechLink

    Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

  96. CVE-2026-40754 8.1 Élevée

    Elated-Themes Roisin

    Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

  97. CVE-2026-40753 8.1 Élevée

    Mikado-Themes EasyMeals

    Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

  98. CVE-2026-40751 8.1 Élevée

    Mikado-Themes Ashtanga

    Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

  99. CVE-2026-40739 8.1 Élevée

    Mikado-Themes LuxeDrive

    Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

  100. CVE-2026-40736 8.1 Élevée

    Edge-Themes Laurits

    Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

  101. CVE-2026-40735 8.1 Élevée

    Edge-Themes Reina

    Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

  102. CVE-2026-40725 9.8 Critique

    Barn2 Media Ltd WooCommerce Product Filters

    Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

  103. CVE-2026-39580 8.1 Élevée

    Select-Themes Micdrop

    Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

  104. CVE-2026-39578 5.5 Moyenne

    Elated-Themes Valiance

    Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

  105. CVE-2026-39577 5.5 Moyenne

    Elated-Themes Playroom

    Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

  106. CVE-2026-39573 8.1 Élevée

    Select-Themes Mildhill

    Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

  107. CVE-2026-39567 8.1 Élevée

    Select-Themes Santé

    Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

  108. CVE-2026-39557 8.1 Élevée

    Elated-Themes NeoBeat

    Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

  109. CVE-2026-39554 8.1 Élevée

    Elated-Themes Fidalgo

    Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

  110. CVE-2026-39545 8.1 Élevée

    Select-Themes Zermatt

    Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

  111. CVE-2026-39539 8.1 Élevée

    Edge-Themes Alloggio - Hotel Booking

    Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

  112. CVE-2026-39529 9.8 Critique

    ThemeREX Group Elementra

    Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

  113. CVE-2026-39446 8.1 Élevée

    PressLayouts Kapee

    Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

  114. CVE-2026-39443 8.1 Élevée

    PressLayouts EmallShop

    Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

  115. CVE-2026-27870 4.8 Moyenne

    Teldat Regesta Smart HD-PLC - TLDPH16D2

    An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting (XSS)  payload into the 'Hostname' field of the configuration file resulting in a XSS in the path /upgrade/query.php?cmd=p+3%3Bversion. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

  116. CVE-2026-27868 6.9 Moyenne

    Teldat Regesta Smart HD-PLC - TLDPH16D2

    An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via the path: /upgrade/query.php?cmd=p+3&3Bversion resulting in a information disclosure. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

  117. CVE-2026-27429 9.8 Critique

    BoldThemes Nifty

    Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

  118. CVE-2026-12165 8.8 Élevée

    contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

    The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the `RegistryUserRole` parameter. This is due to the plugin's admin menu being registered at the `edit_posts` capability level — granting Contributor-level users access to the plugin's admin pages and a valid `cg_admin` nonce — while the option-saving handler in `change-options-and-sizes.php` performs no `current_user_can()` capability check beyond `check_admin_referer('cg_admin')`, and the `RegistryUserRole` value is processed only through `sanitize_text_field()` and `htmlentities()` without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored `RegistryUserRole` option with `administrator`, which the `cg_create_wp_user_from_google_user` function then reads back from the `contest_gal1ery_registry_and_login_options` database table without any allowlist validation and passes directly to `wp_update_user()`, effectively promoting a newly registered Google sign-in account to Administrator.

  119. CVE-2026-12115 6.6 Moyenne

    wpcalc Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress

    The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization is triggered automatically upon the post-import redirect that renders the list table, and again when any item is opened for editing, requiring no additional navigation beyond the import action itself.

  120. CVE-2025-69122 9.8 Critique

    ThemeREX SeaFood Company

    Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

  121. CVE-2025-69108 9.8 Critique

    ThemeREX Hot Coffee

    Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

  122. CVE-2026-6933 8.8 Élevée

    Premmerce Dev Tools

    The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' parameter directly into PHP stub files written to the wp-content/plugins/ directory. An attacker can inject a semicolon followed by arbitrary PHP code into the namespace parameter, causing the generated plugin file to contain and execute that code when accessed via HTTP. This makes it possible for authenticated attackers with Subscriber-level access and above to create arbitrary PHP files on the server and achieve remote code execution.

  123. CVE-2026-48157 6.1 Moyenne

    slimphp Slim

    Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle() and/or setDescription() to include untrusted/request-derived data in the error title or description (e.g. "No products found matching '{$query}'."), an attacker could inject arbitrary HTML/JavaScript that executes in the victim's browser when they encounter an HTML error page generated by Slim. The vulnerability is present even with displayErrorDetails = false as the unescaped title and description are rendered on this error path. Built-in exceptions (HttpNotFoundException, HttpBadRequestException, etc.) ship plain-text defaults, so a vanilla Slim app with no user code is not exploitable. Only applications that feed untrusted data into setTitle() and/or setDescription() are affected. The issue has been fixed in 4.15.2. If developers are unable to immediately update their applications, they can work around this issue by avoiding passing untrusted/request-derived data into HttpException::setTitle() and setDescription() and using static, plain-text error copy instead. They should also register a custom error renderer (an ErrorRendererInterface implementation, or a subclass of HtmlErrorRenderer that escapes the title and description) for the HTML media type.

  124. CVE-2026-9691 9.8 Critique

    CRM Perks Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms

    Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

  125. CVE-2026-49781 9.8 Critique

    Brainstorm Force OttoKit

    Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

  126. CVE-2026-49770 9.8 Critique

    WP Travel Engine

    Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

  127. CVE-2026-49769 9.8 Critique

    Tomdever wpForo Forum

    Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

  128. CVE-2026-49768 9.8 Critique

    Happyforms

    Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

  129. CVE-2026-49765 9.8 Critique

    CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms

    Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

  130. CVE-2026-49763 9.8 Critique

    CRM Perks Integration for Contact Form 7 HubSpot

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

  131. CVE-2026-49109 9.8 Critique

    crm perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

    Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

  132. CVE-2026-49106 9.8 Critique

    CRM Perks Integration for Contact Form 7 and Constant Contact

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

  133. CVE-2026-49105 9.8 Critique

    CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

    Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  134. CVE-2026-49104 9.8 Critique

    CRM Perks Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

    Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

  135. CVE-2026-49085 9.8 Critique

    CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

    Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  136. CVE-2026-42687 8.1 Élevée

    EventPrime

    Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

  137. CVE-2026-39532 8.8 Élevée

    Stiofan Events Calendar for GeoDirectory

    Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

  138. CVE-2026-39499 7.2 Élevée

    Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce

    Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.

  139. CVE-2026-39498 7.2 Élevée

    Yeeaddons YayMail

    Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.

  140. CVE-2026-39481 7.2 Élevée

    WP Chill Modula Image Gallery

    Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.

  141. CVE-2026-39478 8.8 Élevée

    Eli Scheetz Anti-Malware Security and Brute-Force Firewall

    Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.

  142. CVE-2026-39474 8.8 Élevée

    metaphorcreations Post Duplicator

    Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.

  143. CVE-2026-39472 7.2 Élevée

    WP Overnight WooCommerce PDF Invoices & Packing Slips

    Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.

  144. CVE-2026-39471 7.2 Élevée

    ShortPixel Image Optimizer

    Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

  145. CVE-2026-39434 7.2 Élevée

    WebAppick CTX Feed

    Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

  146. CVE-2026-27053 9.8 Critique

    VideoWhisper.com Broadcast Live Video

    Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

  147. CVE-2026-50869 9.8 Critique

    An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.

  148. CVE-2026-49952 9.1 Critique

    Discuz! X5.0

    Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.

  149. CVE-2026-38329 9.8 Critique

    Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.

  150. CVE-2026-36670 8.8 Élevée

    A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table' GET parameter in alias_management.php.