Veille CVE

Jeudi 6 août 2026

18 CVE

Critique 13 Élevée 3 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Php php » ✕
  1. CVE-2026-65581 9.8 Critique

    Axiomthemes AI ANN

    Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.

  2. CVE-2026-65579 9.8 Critique

    axiomthemes Agricola

    Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.

  3. CVE-2026-65578 9.8 Critique

    AncoraThemes Agora

    Unauthenticated PHP Object Injection in Agora <= 1.9 versions.

  4. CVE-2026-65577 9.8 Critique

    AncoraThemes Advice

    Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

  5. CVE-2026-65576 9.8 Critique

    AncoraThemes Adrena

    Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.

  6. CVE-2026-65575 9.8 Critique

    AncoraThemes Accalia

    Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.

  7. CVE-2026-65574 9.8 Critique

    AncoraThemes Abogado

    Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.

  8. CVE-2026-65573 9.8 Critique

    ThemeREX Abelle

    Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

  9. CVE-2026-65572 9.8 Critique

    Axiomthemes A.Williams

    Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

  10. CVE-2026-65571 9.8 Critique

    Axiomthemes 69 Clothing

    Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

  11. CVE-2026-65556 9.8 Critique

    MihChe WPBruiser {no- Captcha anti-Spam}

    Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

  12. CVE-2026-65552 9.8 Critique

    qstudio Export User Data

    Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.

  13. CVE-2026-65549 7.2 Élevée

    jegtheme Jeg Kit for Elementor

    Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

  14. CVE-2026-28139 9.8 Critique

    wpdreams Ajax Search Lite

    Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

  15. CVE-2026-19021 7.3 Élevée

    SourceCodester Computer Repair Shop Management System

    A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

  16. CVE-2026-19020 6.3 Moyenne

    itsourcecode Hospital Management System

    A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

  17. CVE-2026-15991 8.8 Élevée

    bitpressadmin File Manager

    The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrary files on the server, which can lead to remote code execution when the right file is deleted (such as wp-config.php). The bypass is triggered by passing cmd=rm or cmf=file in the URL query string of a POST request: elFinder's bind registration reads the command exclusively from $_POST and therefore never registers the rm.pre permission handler, while the dispatcher reads from the merged $_GET+$_POST superglobal and executes the rm or file command unchecked against a volume that defaults to ABSPATH.

  18. CVE-2026-18968 4.3 Moyenne

    ttttonyhe OBlog

    A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.