PHP

Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.

Reflected JSON injection in PrivateBin v2.0.4 and earlier allows remote unauthenticated attackers to inject arbitrary key/value pairs into JSON-LD API responses served at the /?jsonld= endpoint. PHP's FILTER_SANITIZE_URL passes double-quote characters through unmodified into JSON template construction via str_replace(), breaking out of the JSON string context and reflecting attacker-controlled fields. The vulnerable response path additionally omits X-Content-Type-Options: nosniff while setting Access-Control-Allow-Origin: *, enabling any cross-origin structured-data consumer to read the manipulated output. No public exploit or KEV listing exists, though the advisory includes a dynamically verified proof-of-concept on v2.0.4.

Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.

Remote code execution in Pimcore (all releases up to 12.3.9, plus 2026.1.0 through 2026.1.5) lets any authenticated user holding only the ordinary low-privilege 'objects' DataObjects permission import a DataObject class definition whose field name breaks out of the generated 'protected $<name>;' property and injects attacker-controlled PHP into the class file Pimcore emits, executing arbitrary code as the web-server user when an object of that class is instantiated. The same unvalidated field name is concatenated into ALTER TABLE DDL, giving a parallel SQL-injection primitive. It is an incomplete-fix sibling of CVE-2026-5394, which hardened only the composite-index sink; the advisory (GHSA-9x44-4gxf-8c25) ships a working browser-console PoC, but there is no CISA KEV entry and no EPSS score in the provided data.

PHP Object Injection leading to remote code execution affects the Pimcore DXP/CMS (composer pimcore/pimcore) in versions 2026.1.0-2026.1.5 and all 12.3.x through 12.3.9, where the Hotspotimage DataObject field marshaller deserializes the persisted `*__hotspots` object-store column with no class allowlist. Any attacker able to write crafted PHP-serialized bytes into that column gains arbitrary object instantiation on the next object load, chainable to RCE via gadgets in Pimcore's own bundled dependencies (guzzlehttp/guzzle 7.11.0). A working proof-of-concept demonstrating attacker-controlled file write is published in the vendor advisory; publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided.

phpSysInfo up to and including version 3.4.5 exposes a complete IP allowlist bypass in read_config.php that any unauthenticated remote attacker can exploit by sending a spoofed X-Forwarded-For or Client-IP HTTP header set to any address present in the PSI_ALLOWED configuration. The flaw (CWE-290) renders the application's only access-control mechanism entirely ineffective, allowing full retrieval of system telemetry including hostname, kernel version, CPU model, memory layout, filesystems, and network interface addresses. A working proof-of-concept is publicly available on Exploit-DB; no CISA KEV listing exists at time of analysis.

Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.

Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.

Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.

Unauthenticated information disclosure in WWBN AVideo through version 30.0 exposes user registration statistics via two unprotected PHP endpoints. The report4.json.php and report4.1.json.php files return daily and cumulative user-registration counts to any remote requester without authentication or session validation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, its trivial exploitation path and network accessibility make it easy for any actor who can reach the server to enumerate platform growth data.

Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.

PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.

Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.

Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.

Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.

Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.

Stored Cross-Site Scripting in xipblog v2.0.1 and earlier for PrestaShop allows unauthenticated remote attackers to inject persistent JavaScript payloads through the name and content parameters of ajax.php, which are written to the database without sanitization and rendered unsafely in Smarty templates. When a store administrator subsequently reviews submitted comments in the PrestaShop back office, the payload executes within the admin's authenticated browser session, enabling full store compromise including session hijacking, unauthorized admin actions, and potential exfiltration of customer and payment data. A publicly available proof-of-concept exists per SSVC data and a GitHub Gist reference; exploitation is not currently confirmed in CISA KEV.

Path traversal via unsanitized MIME attachment filenames in Dolibarr's EmailCollector module allows any email sender to write attacker-controlled files outside the intended attachment directory, affecting versions 9.0.0 through 23.0.4. Because the EmailCollector is designed to ingest mail from unauthenticated external senders - such as a support or ticket inbox - no Dolibarr account is required to exploit this flaw. On hardened deployments with a read-only htdocs tree, the attacker can corrupt or forge documents belonging to other objects; on installations where htdocs is writable, the same write primitive reaches web-executable PHP paths, enabling remote code execution. No public exploit identified at time of analysis.

Incorrect authorization in Dolibarr's REST API before version 23.0.4 allows authenticated users holding only read-level module permissions to permanently delete documents via the DELETE /api/index.php/documents endpoint. The flaw in Documents::delete() at htdocs/api/class/api_documents.class.php passes the mode argument 'read' rather than 'write' to dol_check_secure_access_document(), meaning any API account with societe:lire, facture:lire, or equivalent read-only grants can irrecoverably destroy third-party files, invoices, orders, proposals, project files, and generated PDFs. No public exploit has been identified at time of analysis, but the corrective one-line commit diff is publicly visible on GitHub, making the flaw trivial to weaponize for any holder of low-privilege API credentials.

SQL injection in Dolibarr's CSV and XLSX import wizard (all versions before 24.0.0, including the most recent 23.0.4 stable release) allows an authenticated user holding the import permission to inject arbitrary SQL through the unsanitized updatekeys POST parameter. A crafted UNION SELECT payload simultaneously exfiltrates content from any database table the application account can read and hijacks the WHERE clause of the subsequent UPDATE to redirect which row is overwritten; for category link tables the raw filter array is spliced directly into UPDATE statements. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achieve first-party script execution in other users' browser sessions by exploiting an extension-confusion flaw in the product photo upload feature. The application validates file content via magic bytes and rejects known PHP extensions, but then names the stored file using the attacker-supplied client extension - allowing a file prefixed with an image header and carrying an .html extension to pass validation, land in the public web root, and be served as text/html. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 4.8 reflects the authentication and victim-interaction prerequisites.

Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Improper authorization in LimeSurvey Community Edition 7.0.5 allows authenticated users holding only the `settings:read` permission to invoke the survey menu entry creation endpoint (`POST /index.php/admin/menuentries/sa/create`) without the required `settings:update` privilege, constituting vertical privilege escalation within the application's RBAC model. The same endpoint permits submission of menu IDs that the normal interface restricts to superadministrators, enabling unauthorized manipulation of administrative navigation records. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS 4.0 scores this at 5.1 (Medium), consistent with the limited integrity-only impact and high authentication prerequisite.

Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV.

Unsalted MD5 password hashing in FrontAccounting through 2.4.20 renders every stored credential recoverable in minutes if the database is compromised. All authentication-related code paths - user creation, password updates, self-service password change, forgotten-password reset, and login verification - use raw md5() with no per-user salt, so identical passwords produce identical digests and the entire user table can be cracked en masse with rainbow tables or GPU-accelerated tools. No active exploitation (CISA KEV) has been identified, but the CVSS 4.0 score of 8.2 with VC:H reflects that a single database breach translates directly to full plaintext credential exposure across all accounts.

FrontAccounting 2.4.20 and earlier selectively enforces CSRF validation - tokens are generated for every rendered form but the validation call is absent from all financial transaction handlers, including journal entries, supplier invoices, customer payments, bank transactions, and company configuration. An attacker who can induce an authenticated FrontAccounting user to visit a malicious page can silently forge any of those POST requests under the victim's live session, recording fraudulent accounting data without the victim's awareness. No public exploit identified at time of analysis, though a detailed researcher disclosure with technical specifics is publicly available on GitHub.

PHP Object Injection in the Hash Form WordPress plugin (versions 1.4.1 and earlier) lets remote, unauthenticated attackers inject crafted serialized objects that are deserialized by the plugin, enabling code execution, data tampering, or site compromise depending on available gadget chains. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with no authentication required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

PHP Object Injection in the Geo Controller WordPress plugin (the plugin distributed as cf-geoplugin) affects all versions up to and including 8.9.8, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and the CVSS vector reports full confidentiality, integrity, and availability impact, a suitable gadget chain in the plugin or wider WordPress environment could lead to remote code execution, data disclosure, or site takeover. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint.

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.

Unauthenticated log extraction in Veno File Manager 4.4.9 exposes all application log data to any network-reachable attacker via a missing access control check on a PHP admin endpoint. The `/vfm-admin/admin-panel/view/save-cvs.php` script performs no authentication or authorization before processing POST requests, allowing arbitrary retrieval of log records from any specified date onward. A public proof-of-concept repository exists on GitHub (jfs-jfs/CVE-2026-37067); EPSS sits at 0.16% (6th percentile), indicating no widespread exploitation has been observed at time of analysis.

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists.

SQL injection in YzmCMS 7.5 exposes the full database to authenticated administrators who supply a crafted parentid parameter to the category management interface. The flaw arises from unsanitized string concatenation inside a FIND_IN_SET() SQL clause within the get_arrchildid() function, enabling boolean-based blind injection that can enumerate and exfiltrate the entire database. A public proof-of-concept exists on GitHub; however, EPSS at 0.15% (4th percentile) and the absence of a CISA KEV listing indicate no confirmed widespread exploitation at time of analysis.

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header.

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin login endpoint to unauthenticated remote exploitation via the email parameter in /admin/ajax.php?action=login2. The flaw allows attackers to manipulate SQL queries sent to the backend database, enabling authentication bypass and potential data exfiltration or modification. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing is present, but the exploit's public availability materially lowers the barrier to exploitation.

Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.

HTML injection in OpenSTAManager versions 2.10.1 and earlier allows an authenticated high-privilege user to embed arbitrary HTML - including redirect anchor tags - into the user group name field, which is then rendered unsanitized to all users who view the group assignment interface in modules/utenti/edit.php. The attack enables phishing and open-redirect scenarios targeting other application users without requiring any special server configuration. Publicly available exploit code exists (documented in GHSA-crx4-7mmq-j74j with screenshots); this CVE is not in CISA KEV, and EPSS data was not provided.

Unauthenticated PHP object injection in the ILIAS e-learning platform allows remote attackers to achieve code execution as the web server user via the Shibboleth back-channel logout endpoint (shib_logout.php). The endpoint runs on an authentication-exempt path and passes every live session row's stored data through a hand-rolled parser that calls unserialize() with no class allowlist, so an attacker who first seeds a serialized object into a session row (via the equally unauthenticated LTI entry point) triggers a destructor-based POP chain that writes attacker-controlled JSON to an attacker-chosen path below the web root. No public exploit has been identified at time of analysis, but the flaw is unauthenticated and network-reachable, and the vendor CVSS 4.0 base score is 9.3 (Critical).

Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.

Broken authorization in getgrav/grav-plugin-api before 1.0.18 lets a scoped API key that belongs to a super-admin account perform privileged user-management actions it was never scoped for. Across seven sensitive endpoints the requireNotSuperTarget() guard in UsersController.php checks isSuperAdmin() on the underlying account instead of whether the presented key carries super authority (isSuperWithinScope()), so a deliberately down-scoped key can act against other super-admin accounts-disabling their 2FA, deleting avatars, and minting or deleting their API keys. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not on CISA KEV.

Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the Fusion Builder plugin (up to and including 3.16) lets remote attackers plant attacker-controlled files - including executable PHP - leading to remote code execution and full site takeover. The flaw is a cross-component chain of broken authorization and weak input validation (CWE-862) reported by Wordfence, and requires both components active plus specific administrator-authored content to be present. No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Cross-site scripting across three components of Cockpit CMS (item.php, field-select.js, and tags.js) enables remote attackers to inject and execute malicious JavaScript within authenticated users' browser sessions in versions 2.13.5 and prior. The CVSS Scope:Changed metric signals that impact extends beyond the vulnerable component - successful exploitation against an authenticated administrator can result in session hijacking, credential theft, or persistent content manipulation within the CMS. No active exploitation is confirmed (no CISA KEV listing; EPSS 0.30% / 23rd percentile), though a researcher repository at github.com/Securify-AI/CVE-2026-39275 exists as a potential POC reference.

SQL injection in code-projects Simple Inventory System 1.0 exposes the /InventoryManagement/edit.php endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. An attacker with network access can inject arbitrary SQL into backend database queries, enabling unauthorized extraction and modification of all inventory records. Publicly available exploit code exists (CVSS 4.0 E:P), though no CISA KEV listing has been issued, suggesting opportunistic rather than targeted active exploitation at this time.

SQL injection in SililaWijesinghe's PHP-based Food Ordering System allows unauthenticated remote attackers to manipulate the search_box parameter in /search.php, causing the backend database to execute attacker-controlled SQL queries. A public proof-of-concept exploit has been disclosed via GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch available. The CVSS 4.0 vector confirms low-complexity, no-authentication remote exploitability with a confirmed proof-of-concept modifier (E:P).

GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock.

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in /subtitles.php?action=delete.

A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax_get_jf which is later rendered in the data-tooltip attribute in /forums.php?action=viewthread and interpreted as HTML by the Tooltipster configuration.

A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool.

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_view_ips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to tools.php?action=get_cc.

A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to tools.php?action=manage_tags.

Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject malicious client-side scripts via the 'Success' argument in /admin/sumit_form.php. The administrative panel endpoint fails to sanitize user-supplied input before rendering it in the browser response, enabling script injection targeting any user - likely an administrator - who follows a crafted URL. A proof-of-concept exploit has been publicly disclosed on GitHub, though no confirmed active exploitation or CISA KEV listing exists at time of analysis.

The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.

SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credentials to execute arbitrary SQL via the unsanitized 'bo_query' parameter passed to the 'searchByName()' method in 'Address.php'. The scope of the patch (commit 123c97c, PR #1783) reveals the flaw spans at least five PHP files - including 'CustomerMessage.php' and three hotel reservation module classes - each inserting raw user input directly into LIKE or IN SQL clauses without using QloApps' own 'pSQL()' sanitization or integer casting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsanitized input to the 'bo_query' parameter in the back-office search interface. The patch diff reveals the flaw extends beyond CustomerMessage.php to Address.php and multiple hotel reservation system modules (HotelBranchRefundRules, HotelRoomTypeFeaturePricing, HotelRoomTypeGlobalDemandAdvanceOption), all of which concatenated user-supplied strings directly into SQL queries without pSQL() sanitization or integer casting. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data was not provided in the source intelligence.

Local file disclosure in the Kaltura HTML5 player's mwEmbedLoader.php endpoint allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. The root cause is that the ServiceUrl parameter - used as a base URL for backend requests - accepts non-HTTP URI schemes including file://, which the server then fetches; when an exception is raised, the raw deserialized response is reflected back to the client in the error message, leaking file contents. Affected releases span html5lib v2.45, v2.103, and earlier v2.x versions; no public exploit or KEV listing has been identified at time of analysis, though the attack path is straightforward for any attacker with access to the exposed endpoint.

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

Authenticated Twig sandbox escape in Winter CMS before 1.2.13 lets backend users holding template-editing permissions (cms.manage_pages, cms.manage_layouts, or cms.manage_partials) break out of the CMS 'safe mode' to read and modify arbitrary database records, run raw SQL including DDL like DROP TABLE, exfiltrate backend administrator credentials, and achieve PHP remote code execution by writing PHP into a page, layout, or partial code section. It is an incomplete-fix follow-up (bypass) of CVE-2024-54149, whose method-name blocklist missed Eloquent's __call forwarding to the query builder. Rated CVSS 4.0 9.3 (VulnCheck); no public exploit is identified as actively used, though the vendor advisory and added test cases publish working payloads.

Remote code execution in Crater Invoice through 6.0.6 is achievable by any authenticated company owner via a Zip Slip attack against the self-update API's unzip endpoint. Crafted ZIP archives containing path-traversal sequences (`../`) in entry names are passed without sanitization to PHP's `ZipArchive::extractTo()`, enabling arbitrary PHP file writes into the web-accessible `public/` directory and subsequent webshell execution. A public proof-of-concept is available on GitHub; no CISA KEV listing was identified at time of analysis, though the combination of a low exploitation bar and public PoC makes this a priority finding.

PHP Object Injection in the Kalles Addons WordPress plugin (all versions up to and including 1.0.6) allows unauthenticated remote attackers to deserialize untrusted PHP objects via a network-accessible deserialization endpoint. Exploitation is strictly conditional: the plugin itself contains no known POP (Property-Oriented Programming) chain, so real-world impact - ranging from arbitrary file deletion and sensitive data retrieval to remote code execution - only materializes when a separately installed plugin or theme on the same WordPress instance supplies a usable POP chain. No public exploit code and no CISA KEV listing have been identified at time of analysis.

PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. No public exploit code has been identified at time of analysis, though the vulnerability class is well-understood and commonly weaponized; the CVSS 4.0 score of 7.7 reflects the severe potential impact tempered by meaningful exploitation preconditions.

Remote code execution in the TYPO3 'HTML5 Video Player vs. Powermail' extension allows a remote, unauthenticated attacker to achieve arbitrary code execution on the server by supplying a crafted serialized value in an attacker-controlled cookie that is passed to PHP's unserialize(). The flaw is a classic PHP Object Injection (CWE-502) with full confidentiality, integrity, and availability impact and a CVSS 4.0 base score of 9.3. No public exploit identified at time of analysis, but the trivial attack requirements make weaponization straightforward.

Local File Inclusion in Edge-Themes' Shuffle WordPress theme (all versions through 1.8) exposes WordPress installations to unauthenticated remote code execution. An attacker without any credentials can supply a crafted path parameter to the theme's PHP include logic, causing the server to load and execute arbitrary PHP files - including attacker-uploaded content disguised as images. No public exploit has been identified at time of analysis, but the attack pattern (LFI chained with WordPress media uploads) is well-documented in the ecosystem, and the unauthenticated network vector warrants prompt remediation.

Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) enables unauthenticated remote attackers to include and execute arbitrary PHP files on the server. Rooted in CWE-98 (improper PHP include/require path control), the flaw can be chained with file upload functionality - an attacker uploads a PHP-bearing image or other 'safe' file, then triggers the LFI to execute it - yielding full remote code execution, access control bypass, and sensitive data disclosure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.

Local File Inclusion in the Mane WordPress theme (all versions up to and including 1.7) allows unauthenticated remote attackers to include and execute arbitrary server-side PHP files, with a realistic path to full remote code execution when file upload functionality is accessible. The CVSS 8.1 score with AC:H signals that the most severe impact - arbitrary code execution - depends on a specific precondition, most likely an attacker-controlled file already present on the server filesystem. No public exploit has been identified at time of analysis, though the LFI-to-RCE chain on WordPress is a well-understood and widely practiced attack class.

Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level attacker to store a malicious PHP file traversal path via the em_options_save function, which is then executed without any further authentication on every admin_init hook invocation - including unauthenticated admin-ajax.php requests. The two-phase attack converts a high-privilege write primitive into a persistent, unauthenticated code execution trigger that survives account remediation until the stored option is manually purged. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.

Password reset and account activation token comparison in Grav Login Plugin before 3.9.1 uses PHP's non-constant-time === operator instead of hash_equals(), exposing a CWE-208 timing oracle in both taskReset() (classes/Controller.php) and the activation handler (login.php). Combined with the absence of rate limiting on the token-submission endpoint, an unauthenticated network attacker can submit high-volume repeated token guesses against a known username and statistically recover a valid reset token via timing discrepancy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the vendor itself characterizes practical exploitability as low, and no end-to-end network exploitation has been demonstrated.

Email address enumeration in the Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 lets unauthenticated remote attackers determine which email addresses are registered on a Grav CMS site. The register() method returns a distinct EMAIL_NOT_AVAILABLE error for already-registered addresses while proceeding normally otherwise, and because the registration endpoint enforces no rate limiting, an attacker can test addresses at scale, one per request. No public exploit identified at time of analysis; the assigned CVSS 4.0 score of 9.3 appears substantially inflated for what is fundamentally an information-disclosure weakness.

Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.

Remote code execution in Adminer before 5.4.3 (the single-file PHP database management tool) allows unauthenticated attackers to inject ODBC connection parameters through the unsanitized server field of the login form. Because the server value is placed directly into a PDO DSN string for MSSQL/ODBC connections, an attacker can smuggle TraceFile and TraceOn parameters via semicolons to write attacker-controlled PHP into the web root, which executes when the trace file is requested. CVSS 4.0 is rated 9.3 and the flaw was reported by VulnCheck; no public exploit is identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arbitrary PHP files to server-accessible paths and execute OS commands. The vulnerability exploits an incomplete command denylist: while Adminer restricts the ATTACH statement to limit direct file access, the VACUUM INTO command - which writes the current SQLite database to an arbitrary file path - was not blocked. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploit mechanism is straightforward for any authenticated user with SQLite access.

Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-privilege user to deploy a webshell and execute arbitrary code as the web-server user. The root cause is a permissive default extension allowlist that fails to block .php uploads to columns with _path suffixes when the uploadPath directory is web-served. No public exploit has been identified at time of analysis, but the attack chain is technically trivial for anyone with Adminer credentials and requires no user interaction.

Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers operating in SQLite mode by abusing unvalidated relative path input in the db[] parameter during database drop operations. The root cause is a missing file extension check in the SQLite drop action (CWE-22 path traversal), allowing directory traversal sequences to escape the intended SQLite database directory. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the deterministic nature of path traversal exploitation makes the vulnerability straightforward to weaponize once authenticated access is obtained.

Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.

Cookie-path scoping manipulation in Adminer 4.6.0-5.5.0 results from an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php blocks double-slash prefixes (//evil.com) but accepts backslash variants (/\evil.com); because browsers normalize backslash to forward slash, the malformed prefix survives as a network-path reference into cookie_path(), corrupting the Set-Cookie Path attribute. Exploitation depends on a misconfigured or absent reverse proxy that permits clients to supply the X-Forwarded-Prefix header, and no public exploit has been identified at time of analysis.

Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbitrary files on the server by manipulating the `data1` argument passed to PHP's `unlink()` function within the Logo Handler component (`SettingsController.php`). Exploitation is limited to accounts holding high privileges, constraining realistic impact despite network reachability. Publicly available exploit code exists via a GitHub issue report; the vendor has not responded to the disclosure as of time of analysis.

PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.

Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

PHP Object Injection in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing an attacker to inject a serialized PHP object that the plugin deserializes. The vendor advisory (Patchstack) frames this as a 'Subscriber' level issue, meaning a low-privileged authenticated account can supply crafted serialized data; where a suitable POP gadget chain exists in the plugin or its dependencies, this can escalate to code execution, data theft, or site compromise. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Local File Inclusion in MagicAI for WordPress (versions up to and including 1.4) allows authenticated subscribers to include arbitrary PHP files from the server's filesystem by manipulating user-controlled input that is passed to a PHP file-inclusion function without adequate path validation. With CVSS 8.8 (High) and network-accessible exploitation requiring only subscriber-level authentication, this flaw grants attackers full confidentiality, integrity, and availability impact over the affected WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.

Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted requests to the post-ticket-reply endpoint without valid session credentials. The flaw exists in FormController::post_ticket_reply (CWE-306), allowing manipulation of helpdesk communications and injection of fraudulent responses into active support tickets. A proof-of-concept exploit has been publicly published via a GitHub issue, though no vendor patch is available as the maintainers have not yet responded to the disclosure.

Authorization bypass in Dolibarr ERP versions 21.0.0 through 23.x allows authenticated users holding project-creation permission to clone tasks into private projects they are not authorized to access. The flaw is an inverted boolean logic error in the clonetasks mass action handler - `!in_array()` is used where `in_array()` is required, causing the private-project membership check to pass precisely for unauthorized users and fail for authorized ones. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means any authenticated user with project-creation rights can trivially abuse the flaw against any private project in the same Dolibarr instance.

PHP object injection in Combodo iTop's user preference functionality prior to version 3.2.3 enables authenticated remote attackers to achieve remote code execution on the underlying server. The vulnerability stems from deserializing attacker-controlled PHP objects without validation, with the CVSS Scope:Changed metric reflecting that successful exploitation escapes the application boundary to compromise the host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-502 vulnerability class is well-understood and the attack complexity is rated Low once an authenticated session is obtained.