Veille CVE

Lundi 6 juillet 2026

5 CVE sur 20

Critique 2 Élevée 5 Moyenne 12 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « php » ✕
  1. CVE-2026-11962 8.8 Élevée

    Unknown FileOrganizer

    The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.

  2. CVE-2024-6228 7.5 Élevée

    Unknown Notifications for Forms & WordPress Actions

    The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

  3. CVE-2026-14778 7.3 Élevée

    SourceCodester Onlne Examination & Learning Management System

    A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argument student_id/schedule_id/action leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The name of the affected product appears to have a typo in it.

  4. CVE-2026-14772 7.3 Élevée

    SourceCodester Class and Exam Timetabling System

    A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /edit_course1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

  5. CVE-2026-14771 7.3 Élevée

    SourceCodester Class and Exam Timetabling System

    A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected element is an unknown function of the file /edit_exam1.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.