PHP
Monthly
SQL injection in Subrion CMS's admin grid sorting helper exposes virtually all admin grid endpoints to authenticated SQL injection via a raw, unescaped `sort` GET parameter interpolated directly into an ORDER BY clause. Any valid admin session can exploit approximately 29 grid controllers - most of which carry no or incomplete column whitelists - using error-based (EXTRACTVALUE) or time-based (SLEEP) techniques to exfiltrate full database contents, including administrator password hashes. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected endpoints and straightforward technique make exploitation trivial for any attacker holding admin credentials.
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like `passthru` - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with `allow_twig: true`, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.
Time-based blind SQL injection in Cacti's ORDER BY handling allows any authenticated user - regardless of privilege level - to extract, modify, or destroy the Cacti database by supplying a crafted `sort_column` GET parameter to at least four administrative endpoints. The root cause is a regex-based sanitization allowlist in `sanitize_sql_column()` (lib/functions.php) that explicitly permits parentheses to support SQL expressions like `COUNT(id)`, inadvertently passing payloads such as `SLEEP(5)` through unmodified before they are concatenated into unparameterized ORDER BY clauses. No public exploit code or KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a credible priority for any organization running Cacti.
WP-DownloadManager WordPress plugin (all versions prior to 1.69) grants any WordPress administrator holding the manage_downloads capability the ability to achieve full remote code execution by uploading arbitrary PHP files through the unvalidated download-add.php handler. The upload path is additionally constructed from a raw, unsanitized POST parameter, enabling directory traversal into web-accessible locations under WP_CONTENT_DIR where uploaded PHP files execute on direct request. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the complete absence of server-side file-type controls and path sanitization makes exploitation trivially simple for any attacker who has obtained admin credentials.
Unauthenticated remote write access in the toner-management PHP application allowed any attacker to invoke admin-tier database operations - INSERT, UPDATE, and DELETE - across inventory entities including toners, printers, consumers, tickets, and staff records. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, session token, or user interaction are required; the admin write handlers (add.php, edit.php, delete.php) were directly reachable over HTTP and processed SQL operations unconditionally. A fix has been merged via GitHub PR #1 adding session-based admin role validation to all affected handlers, but no formally tagged release version has been confirmed. No public exploit code and no CISA KEV listing are identified at time of analysis.
SQL injection in the Inventory-Management-System-PHP application (Harsh21Patel GitHub project) allows unauthenticated attackers to fully bypass authentication and destructively manipulate the product database. login.php concatenates raw POST email/password into its query, so a payload like email=' OR 1=1 LIMIT 1-- - logs in as the first user, while delete.php runs a DELETE on an unsanitized GET id parameter with no auth check, enabling arbitrary row deletion and blind SQLi. No public exploit identified at time of analysis, though the advisory itself publishes working payloads; the flaw carries CVSS 9.8 and is not listed in CISA KEV.
SQL injection in Mautic's `getLeadIdsByFieldValueAction` endpoint allows any authenticated user to extract arbitrary database contents by supplying a malicious `field` parameter that is concatenated directly into a SQL query as an unvalidated column identifier. The flaw is rooted in Doctrine ORM's structural inability to parameterize SQL identifiers - the only sanitizer applied, `InputHelper::clean()`, HTML-entity-encodes quotes and angle brackets but leaves the spaces, parentheses, and SQL keywords needed for injection entirely intact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low authentication barrier (any valid session) makes this a meaningful risk for organizations with untrusted or externally provisioned Mautic accounts.
Authentication bypass and database exfiltration in Miantang's IoT-PHP application via SQL injection in the login handler. The POST /userlogin route in index.php concatenates the unsanitized $_POST['pwd'] value directly into a MySQL query, letting an unauthenticated attacker log in as any user with a payload like pwd=' OR '1'='1 and use UNION-based injection to read arbitrary database contents. No public exploit identified at time of analysis, though the technique is trivial and well-documented; no EPSS or KEV data was supplied.
Stored XSS in Grocy's API layer allows authenticated users to permanently inject arbitrary script tags into shared application data, executing in the browsers of any user who views affected records. The vulnerability spans all API-writable resource types - products, recipes, stock entries, user records, and chores - making it broadly exploitable across the application. The CVSS score of 8.7 with Scope:Changed reflects the cross-user impact characteristic of stored XSS: a single low-privileged write yields high confidentiality and integrity impact against other users' sessions. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored XSS in InvoiceNinja v5-stable allows an authenticated user with invoice creation access to inject arbitrary JavaScript into the invoice terms field, which executes in a business client's browser when they view the invoice in the client portal. The attack leverages Laravel Blade's raw unescaped output directive in `resources/views/portal/ninja2020/invoices/includes/terms.blade.php`, with no HTML sanitization performed in `StoreInvoiceRequest.php`, enabling session cookie theft and full client account takeover. This is a distinct code path from the previously published CVE-2026-33628 (line-item description XSS), and no public exploit has been identified at time of analysis.
Remote code execution in MacCMS10's admin template editor enables authenticated administrators to execute arbitrary OS commands by exploiting an incomplete PHP function blacklist in conjunction with ThinkPHP's native `{if}` template tag. The `Template.php` controller filtered dangerous functions via regex but omitted `exec`, `passthru`, `popen`, `create_function`, `register_shutdown_function`, `register_tick_function`, `show_source`, and `error_log`, allowing payloads such as `{if condition="exec('id > /tmp/pwned.txt')"}{/if}` to pass validation and execute at render time. No public exploit repository has been independently cited and this CVE is not listed in the CISA KEV catalog; an upstream fix was committed on 2026-06-22.
Authentication bypass and data exfiltration in IOTSmartHome's login component allow an unauthenticated attacker to submit a base64-encoded SQL injection payload via the lastLogin cookie, defeating login checks and reading arbitrary database contents including user credentials. The checkCookie() function in gui/login.php decodes the client-supplied cookie with URL-safe base64 (safe_decode()) and concatenates the result directly into a SQL query without sanitization. No public exploit is identified at time of analysis, but the trivial injection path (base64("' OR '1'='1")) and network reachability make weaponization straightforward.
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Authentication bypass in mrswapnilsahu's Stock-Inventory-Management-System (PHP) lets an unauthenticated remote attacker log in as any user by injecting SQL through the login form. The login.php script concatenates raw POST username/password into the auth query (CWE-89) and also ships hardcoded admin credentials (admin/neola), giving two independent full-bypass paths. No public exploit identified at time of analysis, though the trivial ' OR '1'='1 payload is described directly in the disclosure.
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Remote code execution in Pluck CMS through 4.7.21 is achievable by any authenticated administrator who exploits a gap in the file upload blacklist: the extension '.php8' is absent from the hardcoded deny-list in data/inc/files.php, allowing a crafted file to be stored and subsequently executed as PHP on servers running PHP 8.x. Reported by TuranSec, this CWE-434 flaw carries a CVSS 7.2 (PR:H), meaning exploitation is constrained to admin-level accounts but delivers full confidentiality, integrity, and availability impact once triggered. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the bypass is trivially reproducible from the CVE description by any administrator with upload access.
Unauthenticated payment hijacking in WPFormify - Stripe Payments with Form and Checkout (all versions ≤ 1.1.1) allows any remote attacker to overwrite or delete the site's Stripe API credentials with zero authentication. Two plugin functions registered on WordPress's `admin_init` hook are reachable via the publicly accessible `admin-post.php` endpoint because they perform no capability check and no nonce verification. An attacker exploiting this can silently redirect all customer payments to an attacker-controlled Stripe account, or disable payment processing entirely by erasing the stored credentials - with no public exploit identified at time of analysis but trivially low exploitation complexity.
Unauthenticated sensitive information exposure in the AI Copilot - Content Generator plugin for WordPress (versions up to and including 1.4.6) allows any remote attacker to retrieve plaintext OpenAI API keys and full AI model configurations. The `getCurrentTaskResults()` method is exposed via `wp_ajax_nopriv_` AJAX hooks with no nonce validation, no authorization checks, and no permission guard - making task results freely accessible to unauthenticated callers. Attackers who enumerate sequential integer task IDs can exfiltrate every stored API key, prompt configuration, and keyword set from the site's database. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is trivially exploitable given the low attack complexity.
Remote code execution in the zportals WordPress plugin (all versions before 6.3.4) is achievable by any authenticated user holding a Subscriber role or above, exploiting a server-side file upload validation failure that trusts the client-supplied Content-Type header and preserves the original file extension. By uploading a PHP webshell disguised with a benign MIME type, an attacker can plant executable server-side code and gain full control of the WordPress application layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been observed, but the low authentication barrier makes this a genuine risk for sites with open registration.
Arbitrary file deletion in the Custom Fields WordPress plugin before 1.5.1 allows unauthenticated attackers to delete any file on the server - including wp-config.php - leading to full site takeover. Because the plugin fails to validate a user-supplied path before deletion, a remote attacker needs no authentication or user interaction (CVSS 10.0). Publicly available exploit code exists via WPScan, though EPSS is low (0.17%) and the flaw is not listed in CISA KEV.
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3).
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Authentication bypass in Atlas-Livre, a PHP guestbook/livre d'or web application by maximeAmini, lets unauthenticated remote attackers reach admin-only controller endpoints under Espace_admin/controleur/ and trigger destructive actions such as record deletion. The flaw stems from PHP redirect guards that call header() without a following exit/die, so protected code keeps executing regardless of session state. No public exploit is confirmed via KEV, though a referenced GitHub gist may contain proof-of-concept material; there is no active-exploitation listing at time of analysis.
PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.
Unauthenticated remote code execution in the Improve SEO WordPress plugin (versions through 2.0.11) lets attackers upload executable PHP files by exploiting a file-upload routine that only validates MIME content type while writing files with the attacker-controlled extension into a web-accessible directory. Any visitor can drop a PHP webshell and execute arbitrary code on the server without credentials or user interaction. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not on CISA KEV.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
OS command injection in ClearOS 7.9's Log Viewer component allows authenticated attackers to execute arbitrary commands as the webconfig user and immediately escalate to full root access via default NOPASSWD sudo privileges. The vulnerable parameter (`filter`) in `File.php` is interpolated directly into a shell command without sanitization, making exploitation trivial once credentials are obtained. A public proof-of-concept exploit is available via lazytitan.ro and documented by VulnCheck; no CISA KEV listing is present, so confirmed widespread active exploitation has not been established at time of analysis.
Man-in-the-middle credential theft and AI-response injection affects Emlog Pro through 2.6.23, where the AI integration module (include/service/ai.php) unconditionally disables TLS certificate validation on every outbound HTTPS call to configured LLM providers. A network-adjacent attacker who can intercept this traffic can present any TLS certificate to harvest the Authorization Bearer API keys sent with each AI request and to forge LLM responses that feed the automated tool-call pipeline, including the query_database and update_config handlers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects the high confidentiality and integrity impact.
WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.
Code injection in WebsiteBaker CMS before 2.13.10 allows an authenticated administrator to plant a PHP webshell that is subsequently exploitable by unauthenticated remote attackers. The Droplets editor's save_droplet handler writes the Code field verbatim - without any content sanitization - to a publicly accessible PHP file inside the modules directory. Once an admin submits malicious PHP, any unauthenticated user can trigger full remote code execution by issuing a direct HTTP request to the predictable file path. A public proof-of-concept exploit exists; no CISA KEV listing at time of analysis.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so that arbitrary PHP runs as the web server user. The flaw lives in library/classes/Tree.class.php, where an attacker chains SQL execution to change the categories table id column to VARCHAR and store a PHP payload that a later unsanitized eval() executes every time any page - including unauthenticated and low-privilege ones - instantiates CategoryTree, turning a one-time admin action into a persistent server-wide backdoor. Publicly available exploit code exists (documented by VulnCheck and Jiva Security), and CVSS 4.0 is 9.4; no active exploitation is confirmed in CISA KEV at time of analysis.
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
OS command injection in Telenia Software TVox allows authenticated high-privilege attackers to execute arbitrary operating system commands via the unsanitized `pid` parameter in `action_audio.php`. Affected deployments span TVox 26.x through 26.5.3 and 24.x through 24.9.21, running on an Apache/PHP stack where successful exploitation yields command execution as the `apache` system user. A publicly available proof-of-concept exploit exists (KarmaInSecurity KIS-2026-15, confirmed by VulnCheck), though no CISA KEV listing is present, indicating active exploitation is not yet confirmed at scale.
Authentication bypass in Telenia Software TVox (versions 24.x ≤24.9.21 and 26.x ≤26.5.3) lets remote unauthenticated attackers reach every PHP script under the manager HTML directory by appending '/login_admin.php' to any target script's path. The flaw stems from set_env.php trusting the client-controllable PHP_SELF value when deciding whether to skip authentication. Publicly available exploit code exists (KarmaInSecurity KIS-2026-14, reported by VulnCheck), but there is no CISA KEV listing, so treat it as no public active exploitation confirmed despite a ready POC.
Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.
Authentication bypass in Admidio's forum module before version 5.0.11 enables unauthenticated network-accessible attackers to read private forum topics and posts that administrators intended to restrict to logged-in members. The flaw stems from `modules/forum.php` failing to validate the login-only configuration state before serving content, meaning a direct HTTP request with read-only parameters is sufficient to circumvent the access gate. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, but the mechanistic simplicity of the bypass - a direct module access with no authentication - means exploitation requires minimal skill once a vulnerable, login-only-configured instance is located.
Arbitrary public static PHP method invocation in Grav CMS 2.0.7-2.0.10 allows any account holding page-editing rights (admin.pages) to read arbitrary server-readable files and create or copy files and directories under the web-server account. The flaw lies in Blueprint::isSafeDynamicCall(), which skips its dangerous-callable denylist entirely for strings containing '::' - meaning fully-qualified Class::method notation in blueprint dynamic-field directives is never checked against the blocklist. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis, but the low-privilege requirement and high-impact outcome make this a credible internal threat in multi-tenant or shared Grav deployments.
Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) allows unauthenticated attackers to upload arbitrary PHP files via a handler that fails to restrict uploaded file types, and those files are directly reachable and executable on the server. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 base score is 9.8, though the EPSS probability is low at 0.22% (13th percentile). This is a classic unauthenticated file-upload-to-RCE flaw that grants full server compromise with no authentication or user interaction.
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.
SQL injection in FastAdmin v1.6.1.20250430 lets remote attackers inject arbitrary SQL through the application/common/controller/Backend.php component, with the vendor advisory characterizing the impact as extending to arbitrary code execution. The flaw is tagged RCE/SQLi/PHP and carries a CVSS 9.8 rating with total technical impact per CISA's SSVC framework, though publicly available exploit code exists rather than confirmed active exploitation. EPSS is low (0.14%, 4th percentile), suggesting exploitation is not yet widespread despite the critical severity.
Unrestricted PHP file upload in the Theme Demo Import WordPress plugin (≤1.1.3) enables administrator-level users - including non-super-admin site admins on multisite installs - to bypass WordPress's native file-type validation and upload executable PHP files to the server's uploads directory, resulting in full remote code execution. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.14% (4th percentile), suggesting exploitation remains uncommon. No confirmed active exploitation in CISA KEV; however, SSVC rates technical impact as total.
Unrestricted PHP file upload in Everest Toolkit (WordPress plugin ≤1.2.3) enables authenticated Administrators - including non-super-admin site administrators on multisite networks - to place executable PHP web shells in the wp-content/uploads directory via the demo-content import feature. Full remote code execution on the underlying web server is achievable upon requesting the uploaded file. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), indicating this remains a targeted rather than widespread threat despite total technical impact.
Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical).
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with media upload permissions via a multi-segment filename bypass (e.g., shell.php.any.jpg) that defeats the extension blocklist in rex_mediapool::isAllowedExtension. The flaw is a confirmed regression introduced in PR #6213 (February 2025), which replaced a historically correct str_contains guard with weaker str_ends_with logic, reintroducing a double-extension attack class that the codebase had explicitly defended against since 2018. Exploitation additionally requires the target server to run a multi-extension PHP handler (Apache mod_mime AddHandler or unanchored FilesMatch); no public exploit or CISA KEV listing has been identified at time of analysis, and the vendor-released fix is available in version 5.21.1.
SQL injection in PHP Jabbers PHP Poll Script (versions prior to 4.1) allows an authenticated attacker with administrative access to inject arbitrary SQL through the pjAdminPolls.controller.php endpoint, where user-supplied input is not properly neutralized before being used in database queries. Successful exploitation can expose or modify poll and backend database contents (CVSS 4.0 base 8.6, high confidentiality/integrity impact). There is no public exploit identified at time of analysis and no active-exploitation (KEV) listing; the fix landed in version 4.1.
Remote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated administrator to inject arbitrary PHP code into server-side execution by crafting a malicious custom widget definition. The plugin writes this definition verbatim into a generated PHP file and subsequently executes it without sanitization. The critical escalation scenario occurs on WordPress multisite networks, where a subsite Administrator - ordinarily barred from file or code editing - can exploit this flaw to achieve host-level code execution, bypassing the privilege boundaries the network enforces. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.
Unauthenticated file upload validation bypass in the CodeIgniter4 PHP framework (versions prior to 4.7.4) lets a remote attacker upload executable PHP content by exploiting that the is_image and mime_in strict validation rules never enforced a safe client-supplied filename extension. Applications are affected only when they validate uploads solely with is_image or mime_in (without an independent extension check such as ext_in), persist files under the attacker-controlled client filename, and store them in a web-accessible, script-enabled directory. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list; the upstream fix (commit b6e9a4f, released as v4.7.4) adds client-extension consistency checks.
Path traversal file write in the CodeIgniter4 PHP framework prior to 4.7.4 lets remote unauthenticated attackers place uploaded files outside the intended directory whenever an application calls UploadedFile::move() without an explicit second (name) argument. Because the default used the raw client-supplied filename, traversal sequences such as '../../public/shell.php' could drop attacker-controlled content into web-accessible or sensitive locations, potentially enabling code execution on affected sites. No public exploit identified at time of analysis, though the fixing commit ships a regression test that concretely demonstrates the traversal payload.
SQL injection in CodeIgniter4's Query Builder deleteBatch() method (versions 4.3.0 through 4.7.3) allows user-controlled where() condition values to be interpreted as executable SQL because bound values are substituted into the generated DELETE statement while their escape flags are ignored. Only the deleteBatch() batch-delete path is affected; ordinary delete() operations escape their binds correctly. No public exploit was identified at time of analysis, and the flaw is resolved in version 4.7.4.
Privilege escalation via authorization bypass in Wolf CMS (through 0.8.3.1) lets any authenticated non-administrative user reach the BackupRestoreController and create, download, and restore site backups that should be admin-only. The root cause is a PHP operator-precedence mistake in the permission-check expression, so the access control evaluates incorrectly and grants low-privileged accounts admin-tier backup functionality. Publicly available exploit code exists (published by VulnCheck), but there is no public exploit identified in CISA KEV, so active exploitation is not confirmed.
Remote code execution in Wolf CMS through version 0.8.3.1 allows authenticated attackers holding the file_manager_mkfile capability to write arbitrary PHP files into the web-accessible FILES_DIR and execute them by requesting the file over HTTP. The flaw stems from missing file-extension validation in the FileManagerController create_file() and save() functions (CWE-434). Publicly available exploit code exists (via VulnCheck advisory), though it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in the session of any logged-in user because the Laravel VerifyCsrfToken middleware was commented out of the global middleware stack in HttpKernel.php, leaving every POST/PUT/DELETE endpoint token-free. A victim who is authenticated and visits an attacker-controlled page can be forced to create or delete projects, alter settings, and change permissions. Publicly available exploit code exists (GHSA-x8vx-9g5w-w5rr) and the flaw was reported by VulnCheck, though there is no public exploit identified as actively exploited (not in CISA KEV); EPSS was not provided.
Server-side request forgery in Kanboard 1.2.52 and earlier lets authenticated users pivot into internal networks by encoding target IP addresses in hexadecimal notation, which slips past the application's SSRF allow-list check. Because the isPrivateURL() filter in app/Core/Http/Client.php relies on FILTER_VALIDATE_IP - which rejects non-dotted-decimal formats - a hex-encoded address like 0x7f000001 is deemed 'not a private IP' and forwarded to cURL, which happily resolves and connects to it. Publicly available exploit code exists (a proof-of-concept gist), though there is no public exploit identified as being used in active attacks; EPSS was not provided.
Second-order PHP code execution in e107 CMS before version 2.3.8 lets an attacker who already holds out-of-band write access to the database plant a crafted payload in the user_prefs column, which is later fed to eval() when that user's preferences load. The e_array::unserialize() handler validates only that the stored string begins with 'array' before evaluating it, so any account whose preferences are materialized triggers arbitrary PHP execution. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds write in PHP's BCMath bccomp() function allows attacker-controlled inputs to corrupt stack and heap memory in PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9, with high confidentiality, integrity, and availability impact per the vendor CVSS 4.0 score of 8.1. Exploitation requires an application to pass attacker-influenced values into bccomp() with the BCMath extension enabled; there is no public exploit identified at time of analysis (CVSS E:U, no KEV listing). Memory corruption of this class can lead to crashes and, potentially, arbitrary code execution within the PHP process.
SQL injection in the PHP interpreter's string-escaping routine affects PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9, where backslashes in attacker-controlled parameters are improperly escaped, allowing malicious input to break out of quoted SQL string literals. Any web application relying on PHP's built-in escaping to sanitize user data before database queries can be subverted, enabling trivial injection. This is a CWE-89 flaw reported by the PHP project (advisory GHSA-7qpv-r5mr-78m4); no public exploit identified at time of analysis, and CVSS 4.0 rates it 8.1 with exploitation marked automatable.
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.
PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users with subscriber-level access or higher to deserialize attacker-controlled data through XProfile textbox fields, which can escalate to remote code execution when a usable POP gadget chain exists in the WordPress stack. The flaw stems from bp_unserialize_profile_field() calling @unserialize() on user-supplied profile data without the allowed_classes safeguard. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the moderate CVSS of 7.5 reflects the dependency on an available gadget chain (high attack complexity).
OS command injection in dnsmgr version 2.15 and earlier lets an attacker execute arbitrary commands through the ping function in CheckUils.php, which passes unsanitized input into a system shell call (CWE-77). SSVC rates the technical impact as total and marks exploitation as proof-of-concept, so publicly available exploit code exists, though it is not on CISA KEV and EPSS is low (0.15%). The published CVSS is 9.8, but note the description characterizes the attacker as 'local' while the CVSS vector encodes AV:N - this discrepancy affects real-world exposure and should be resolved against the target deployment.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
Remote code execution in the Aimy Captcha-Less Form Guard plugin for Joomla (versions 18.0 through 20.0) allows unauthenticated attackers to run arbitrary PHP by submitting a forged 'clfgd' form field that the plugin deserializes, triggering PHP object injection. Any unpatched Joomla site running this plugin is exposed to full server compromise over the network without authentication or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CWE-502 root cause and maximal CVSS 4.0 score (10.0) make this a critical-priority issue.
Remote code execution in the StyleMixThemes Cost Calculator Builder PRO WordPress plugin (versions up to and including 4.0.3) lets unauthenticated attackers run arbitrary PHP on the server by injecting non-word XOR gadgets into the orderDetails[*].originalValue field, which is passed verbatim into a PHP eval() call inside js_to_php(). The only gate is a nonce, but that nonce is printed on every front-end page via wp_head, so any anonymous visitor can retrieve it, effectively removing the authentication barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.8 rating and trivial nonce bypass make this a high-priority, pre-authentication server-takeover flaw.
Arbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full server compromise by uploading a malicious SCORM package containing a PHP webshell. The uploaded file is placed in a publicly accessible directory, enabling the attacker to execute arbitrary commands on the underlying server. No evidence of active exploitation or public exploit code exists at this time, but the CVSS score of 9.9 reflects critical severity.
Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.
We are tasked with synthesizing a comprehensive analysis about CVE-2026-66745 from multiple sources, outputting a plain-text JSON. Let's go through each field. First, understand the CVE: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) has a session fixation vulnerability. Unauthenticated attackers can set a known PHPSESSID on a victim's browser before authentication, and when the victim authenticates via fw.login.php, the attacker gains administrative session on port 9000. CVSS 4.0 vector given: AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-94 (Code Injection) is listed, but that seems odd for session fixation; maybe it's misattributed? But we'll use provided data. Tags: RCE, PHP, Code Injection, Artica Proxy. RCE? Session fixation doesn't give RCE directly; maybe there's more to it? Description only mentions session fixation leading to admin session hijack. Might be an error in tags. We'll stay factual. CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:* (all versions pre-fix). Patch: Available, with hotfix version 20260724-02 (provided). References: Articatech wiki, hotfixes page, VulnCheck advisory. Now we need to fill fields. product_name: "Artica Proxy" - that's the product, matches CPE. Only 1-3 words. Yes. summary: Start with specific impact verb and product. Not "A vulnerability..." So: "Administrative session hijacking in Artica Proxy before 4.50.000000 SP7 allows unauthenticated attackers to pre-set a session ID on a victim's browser, then wait for the victim to authenticate via fw.login.php, gaining full administrative control on port 9000. The vulnerability is a session fixation flaw with a CVSS 4.0 base score of 7.5. No exploitation evidence (KEV) or public POC is currently confirmed, but a hotfix is available." It says "session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions", so impact is administrative session hijack. So summary: "Administrative session h
Privilege escalation in Pterodactyl Wings allows authenticated subusers to upload arbitrary files without the required file.create permission by reusing lower-privilege panel-signed JWTs (e.g., from websocket authentication or file downloads). A public proof-of-concept demonstrates how a subuser with only websocket.connect can upload files to the server, potentially compromising its container. Patches introduce JWT scoping in Panel 1.12.3 and Wings 1.12.2.
Authentication denial of service in Pterodactyl Panel 1.7.0–1.12.4 allows an unauthenticated remote attacker to lock out all users from login and two-factor authentication by exhausting a single shared rate-limit bucket with approximately 10 requests per minute. The attacker can sustain the lockout indefinitely, preventing legitimate access including administrative login. A proof-of-concept is publicly available, though no active exploitation has been reported via CISA KEV.
Arbitrary command execution in WordPress Coding Standards (WordPressCS) before 3.4.1 lets attacker-controlled PHP source trigger code execution on the machine running the linter. The flawed WordPress.WP.EnqueuedResourceParameters sniff reconstructed the $ver argument of wp_enqueue_script()/wp_register_script() and passed it to eval(), so scanning a malicious file (for example a pull request in CI) with the WordPress or WordPress-Extra rulesets runs the attacker's payload. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the technical impact is total and a patched release (3.4.1) is available.
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privileges by injecting forged identity headers that upstream applications may trust. The oauth-proxy fails to strip underscore-variant headers, enabling WSGI and PHP frameworks to normalize them into the legitimate identity, potentially overriding the true authenticated user. No known active exploitation or public exploit code has been identified.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Remote code execution in phpMyFAQ before version 4.1.6 allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files to the server. By uploading a malicious ZIP file as an attachment and then manipulating the upgrade.lastDownloadedPackage configuration setting to point to that file, an attacker can extract attacker-controlled PHP code into the web root, leading to code execution as the web server user. No known public exploit code or active exploitation has been reported at the time of this analysis.
Path traversal in phpMyFAQ's category image deletion allows authenticated attackers to delete arbitrary files, leading to superadmin account creation. Versions before 4.1.6 fail to sanitize the existing_image parameter, permitting deletion of critical files like database.php, which disables the installation gate and exposes the setup wizard. Publicly available exploit code exists, and the issue has been verified by the vendor.
Remote code execution in vBulletin 5.x and 6.x allows unauthenticated attackers to execute arbitrary PHP code via a crafted request to the ajax/render endpoint. The vulnerability resides in the vB5_Template_Runtime::runMaths() method, where an insufficient regex filter can be bypassed using phpfuck-style encoding to inject and evaluate arbitrary PHP. Publicly available exploit code exists, and no CISA KEV listing was identified at the time of analysis, but the lack of authentication makes unpatched instances critically exposed.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Information disclosure in Dede CMS 5.7.118 allows remote unauthenticated attackers to retrieve sensitive data via the 'str' parameter in the file_manage_control.php component. No active exploitation has been confirmed, but a public write-up with exploit details is available on a Gitee repository.
SQL injection in Dede CMS 5.7.118 via the sqlquery parameter of sys_sql_query.php allows unauthenticated remote attackers to extract arbitrary database contents, including sensitive information. A publicly available proof-of-concept exploit exists, although no active exploitation has been confirmed.
An authenticated PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress (versions ≤6.2.6) allows a user with Subscriber-level privileges to inject a malicious serialized PHP object via deserialization of untrusted input. If a suitable POP chain is present and the user update integration is enabled with a mapped user meta field, the attacker can change user passwords and ultimately take over administrator accounts. Public exploit code is available, but the EPSS score (0.38%) suggests low real-world exploitation probability and the vulnerability is not listed in CISA's KEV.
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger infinite loops when processing malformed varint input, affecting Python, Go, PHP, and Java bindings before version 0.24.0. Exploitation can exhaust CPU resources, making the service unresponsive; no active exploitation or public exploit code is known at this time.
Authenticated SQL injection in Likeshop up to 3.0.5 allows admin-level users to extract arbitrary database contents via the adjustAccount endpoint. The vulnerability stems from unsanitized POST parameters (money, integral, growth, earnings) concatenated directly into raw SQL queries. Exploit code is publicly available, though no active exploitation has been reported by CISA.
Denial of service in PhpSpreadsheet (PHPOffice) versions 2.0.0 through 5.8.0 lets remote unauthenticated attackers crash a PHP worker with a ~1 KiB malformed XLS/OLE file. The library's OLERead::read() follows attacker-controlled OLE sector chains without cycle detection, so a sector that points back to itself makes the small-block depot loop append the same data until memory is exhausted. It is triggered during automatic format detection via Reader\Xls::canRead(), so any app that probes untrusted spreadsheet uploads is affected; a working proof of concept is published in the vendor advisory, though the flaw is not in CISA KEV.
Denial-of-service in PhpSpreadsheet's Gnumeric reader lets remote attackers crash PHP worker processes by uploading a tiny gzip-compressed .gnumeric file that decompresses to hundreds of megabytes. The reader's Gnumeric::canRead() calls gzdecode() with no decompressed-size cap during routine file-type detection, so a ~98 KB payload expanding to ~96 MiB exhausts a 64M memory limit and triggers a fatal error before validation. No public exploit is identified at time of analysis, but a working proof-of-concept is described in the advisory and the CVSS score is 7.5 (High) with A:H impact.
Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in Subrion CMS's admin grid sorting helper exposes virtually all admin grid endpoints to authenticated SQL injection via a raw, unescaped `sort` GET parameter interpolated directly into an ORDER BY clause. Any valid admin session can exploit approximately 29 grid controllers - most of which carry no or incomplete column whitelists - using error-based (EXTRACTVALUE) or time-based (SLEEP) techniques to exfiltrate full database contents, including administrator password hashes. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected endpoints and straightforward technique make exploitation trivial for any attacker holding admin credentials.
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like `passthru` - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with `allow_twig: true`, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.
Time-based blind SQL injection in Cacti's ORDER BY handling allows any authenticated user - regardless of privilege level - to extract, modify, or destroy the Cacti database by supplying a crafted `sort_column` GET parameter to at least four administrative endpoints. The root cause is a regex-based sanitization allowlist in `sanitize_sql_column()` (lib/functions.php) that explicitly permits parentheses to support SQL expressions like `COUNT(id)`, inadvertently passing payloads such as `SLEEP(5)` through unmodified before they are concatenated into unparameterized ORDER BY clauses. No public exploit code or KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a credible priority for any organization running Cacti.
WP-DownloadManager WordPress plugin (all versions prior to 1.69) grants any WordPress administrator holding the manage_downloads capability the ability to achieve full remote code execution by uploading arbitrary PHP files through the unvalidated download-add.php handler. The upload path is additionally constructed from a raw, unsanitized POST parameter, enabling directory traversal into web-accessible locations under WP_CONTENT_DIR where uploaded PHP files execute on direct request. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the complete absence of server-side file-type controls and path sanitization makes exploitation trivially simple for any attacker who has obtained admin credentials.
Unauthenticated remote write access in the toner-management PHP application allowed any attacker to invoke admin-tier database operations - INSERT, UPDATE, and DELETE - across inventory entities including toners, printers, consumers, tickets, and staff records. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, session token, or user interaction are required; the admin write handlers (add.php, edit.php, delete.php) were directly reachable over HTTP and processed SQL operations unconditionally. A fix has been merged via GitHub PR #1 adding session-based admin role validation to all affected handlers, but no formally tagged release version has been confirmed. No public exploit code and no CISA KEV listing are identified at time of analysis.
SQL injection in the Inventory-Management-System-PHP application (Harsh21Patel GitHub project) allows unauthenticated attackers to fully bypass authentication and destructively manipulate the product database. login.php concatenates raw POST email/password into its query, so a payload like email=' OR 1=1 LIMIT 1-- - logs in as the first user, while delete.php runs a DELETE on an unsanitized GET id parameter with no auth check, enabling arbitrary row deletion and blind SQLi. No public exploit identified at time of analysis, though the advisory itself publishes working payloads; the flaw carries CVSS 9.8 and is not listed in CISA KEV.
SQL injection in Mautic's `getLeadIdsByFieldValueAction` endpoint allows any authenticated user to extract arbitrary database contents by supplying a malicious `field` parameter that is concatenated directly into a SQL query as an unvalidated column identifier. The flaw is rooted in Doctrine ORM's structural inability to parameterize SQL identifiers - the only sanitizer applied, `InputHelper::clean()`, HTML-entity-encodes quotes and angle brackets but leaves the spaces, parentheses, and SQL keywords needed for injection entirely intact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low authentication barrier (any valid session) makes this a meaningful risk for organizations with untrusted or externally provisioned Mautic accounts.
Authentication bypass and database exfiltration in Miantang's IoT-PHP application via SQL injection in the login handler. The POST /userlogin route in index.php concatenates the unsanitized $_POST['pwd'] value directly into a MySQL query, letting an unauthenticated attacker log in as any user with a payload like pwd=' OR '1'='1 and use UNION-based injection to read arbitrary database contents. No public exploit identified at time of analysis, though the technique is trivial and well-documented; no EPSS or KEV data was supplied.
Stored XSS in Grocy's API layer allows authenticated users to permanently inject arbitrary script tags into shared application data, executing in the browsers of any user who views affected records. The vulnerability spans all API-writable resource types - products, recipes, stock entries, user records, and chores - making it broadly exploitable across the application. The CVSS score of 8.7 with Scope:Changed reflects the cross-user impact characteristic of stored XSS: a single low-privileged write yields high confidentiality and integrity impact against other users' sessions. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored XSS in InvoiceNinja v5-stable allows an authenticated user with invoice creation access to inject arbitrary JavaScript into the invoice terms field, which executes in a business client's browser when they view the invoice in the client portal. The attack leverages Laravel Blade's raw unescaped output directive in `resources/views/portal/ninja2020/invoices/includes/terms.blade.php`, with no HTML sanitization performed in `StoreInvoiceRequest.php`, enabling session cookie theft and full client account takeover. This is a distinct code path from the previously published CVE-2026-33628 (line-item description XSS), and no public exploit has been identified at time of analysis.
Remote code execution in MacCMS10's admin template editor enables authenticated administrators to execute arbitrary OS commands by exploiting an incomplete PHP function blacklist in conjunction with ThinkPHP's native `{if}` template tag. The `Template.php` controller filtered dangerous functions via regex but omitted `exec`, `passthru`, `popen`, `create_function`, `register_shutdown_function`, `register_tick_function`, `show_source`, and `error_log`, allowing payloads such as `{if condition="exec('id > /tmp/pwned.txt')"}{/if}` to pass validation and execute at render time. No public exploit repository has been independently cited and this CVE is not listed in the CISA KEV catalog; an upstream fix was committed on 2026-06-22.
Authentication bypass and data exfiltration in IOTSmartHome's login component allow an unauthenticated attacker to submit a base64-encoded SQL injection payload via the lastLogin cookie, defeating login checks and reading arbitrary database contents including user credentials. The checkCookie() function in gui/login.php decodes the client-supplied cookie with URL-safe base64 (safe_decode()) and concatenates the result directly into a SQL query without sanitization. No public exploit is identified at time of analysis, but the trivial injection path (base64("' OR '1'='1")) and network reachability make weaponization straightforward.
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Authentication bypass in mrswapnilsahu's Stock-Inventory-Management-System (PHP) lets an unauthenticated remote attacker log in as any user by injecting SQL through the login form. The login.php script concatenates raw POST username/password into the auth query (CWE-89) and also ships hardcoded admin credentials (admin/neola), giving two independent full-bypass paths. No public exploit identified at time of analysis, though the trivial ' OR '1'='1 payload is described directly in the disclosure.
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Remote code execution in Pluck CMS through 4.7.21 is achievable by any authenticated administrator who exploits a gap in the file upload blacklist: the extension '.php8' is absent from the hardcoded deny-list in data/inc/files.php, allowing a crafted file to be stored and subsequently executed as PHP on servers running PHP 8.x. Reported by TuranSec, this CWE-434 flaw carries a CVSS 7.2 (PR:H), meaning exploitation is constrained to admin-level accounts but delivers full confidentiality, integrity, and availability impact once triggered. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the bypass is trivially reproducible from the CVE description by any administrator with upload access.
Unauthenticated payment hijacking in WPFormify - Stripe Payments with Form and Checkout (all versions ≤ 1.1.1) allows any remote attacker to overwrite or delete the site's Stripe API credentials with zero authentication. Two plugin functions registered on WordPress's `admin_init` hook are reachable via the publicly accessible `admin-post.php` endpoint because they perform no capability check and no nonce verification. An attacker exploiting this can silently redirect all customer payments to an attacker-controlled Stripe account, or disable payment processing entirely by erasing the stored credentials - with no public exploit identified at time of analysis but trivially low exploitation complexity.
Unauthenticated sensitive information exposure in the AI Copilot - Content Generator plugin for WordPress (versions up to and including 1.4.6) allows any remote attacker to retrieve plaintext OpenAI API keys and full AI model configurations. The `getCurrentTaskResults()` method is exposed via `wp_ajax_nopriv_` AJAX hooks with no nonce validation, no authorization checks, and no permission guard - making task results freely accessible to unauthenticated callers. Attackers who enumerate sequential integer task IDs can exfiltrate every stored API key, prompt configuration, and keyword set from the site's database. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is trivially exploitable given the low attack complexity.
Remote code execution in the zportals WordPress plugin (all versions before 6.3.4) is achievable by any authenticated user holding a Subscriber role or above, exploiting a server-side file upload validation failure that trusts the client-supplied Content-Type header and preserves the original file extension. By uploading a PHP webshell disguised with a benign MIME type, an attacker can plant executable server-side code and gain full control of the WordPress application layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been observed, but the low authentication barrier makes this a genuine risk for sites with open registration.
Arbitrary file deletion in the Custom Fields WordPress plugin before 1.5.1 allows unauthenticated attackers to delete any file on the server - including wp-config.php - leading to full site takeover. Because the plugin fails to validate a user-supplied path before deletion, a remote attacker needs no authentication or user interaction (CVSS 10.0). Publicly available exploit code exists via WPScan, though EPSS is low (0.17%) and the flaw is not listed in CISA KEV.
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3).
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Authentication bypass in Atlas-Livre, a PHP guestbook/livre d'or web application by maximeAmini, lets unauthenticated remote attackers reach admin-only controller endpoints under Espace_admin/controleur/ and trigger destructive actions such as record deletion. The flaw stems from PHP redirect guards that call header() without a following exit/die, so protected code keeps executing regardless of session state. No public exploit is confirmed via KEV, though a referenced GitHub gist may contain proof-of-concept material; there is no active-exploitation listing at time of analysis.
PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.
Unauthenticated remote code execution in the Improve SEO WordPress plugin (versions through 2.0.11) lets attackers upload executable PHP files by exploiting a file-upload routine that only validates MIME content type while writing files with the attacker-controlled extension into a web-accessible directory. Any visitor can drop a PHP webshell and execute arbitrary code on the server without credentials or user interaction. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not on CISA KEV.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
OS command injection in ClearOS 7.9's Log Viewer component allows authenticated attackers to execute arbitrary commands as the webconfig user and immediately escalate to full root access via default NOPASSWD sudo privileges. The vulnerable parameter (`filter`) in `File.php` is interpolated directly into a shell command without sanitization, making exploitation trivial once credentials are obtained. A public proof-of-concept exploit is available via lazytitan.ro and documented by VulnCheck; no CISA KEV listing is present, so confirmed widespread active exploitation has not been established at time of analysis.
Man-in-the-middle credential theft and AI-response injection affects Emlog Pro through 2.6.23, where the AI integration module (include/service/ai.php) unconditionally disables TLS certificate validation on every outbound HTTPS call to configured LLM providers. A network-adjacent attacker who can intercept this traffic can present any TLS certificate to harvest the Authorization Bearer API keys sent with each AI request and to forge LLM responses that feed the automated tool-call pipeline, including the query_database and update_config handlers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects the high confidentiality and integrity impact.
WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.
Code injection in WebsiteBaker CMS before 2.13.10 allows an authenticated administrator to plant a PHP webshell that is subsequently exploitable by unauthenticated remote attackers. The Droplets editor's save_droplet handler writes the Code field verbatim - without any content sanitization - to a publicly accessible PHP file inside the modules directory. Once an admin submits malicious PHP, any unauthenticated user can trigger full remote code execution by issuing a direct HTTP request to the predictable file path. A public proof-of-concept exploit exists; no CISA KEV listing at time of analysis.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so that arbitrary PHP runs as the web server user. The flaw lives in library/classes/Tree.class.php, where an attacker chains SQL execution to change the categories table id column to VARCHAR and store a PHP payload that a later unsanitized eval() executes every time any page - including unauthenticated and low-privilege ones - instantiates CategoryTree, turning a one-time admin action into a persistent server-wide backdoor. Publicly available exploit code exists (documented by VulnCheck and Jiva Security), and CVSS 4.0 is 9.4; no active exploitation is confirmed in CISA KEV at time of analysis.
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
OS command injection in Telenia Software TVox allows authenticated high-privilege attackers to execute arbitrary operating system commands via the unsanitized `pid` parameter in `action_audio.php`. Affected deployments span TVox 26.x through 26.5.3 and 24.x through 24.9.21, running on an Apache/PHP stack where successful exploitation yields command execution as the `apache` system user. A publicly available proof-of-concept exploit exists (KarmaInSecurity KIS-2026-15, confirmed by VulnCheck), though no CISA KEV listing is present, indicating active exploitation is not yet confirmed at scale.
Authentication bypass in Telenia Software TVox (versions 24.x ≤24.9.21 and 26.x ≤26.5.3) lets remote unauthenticated attackers reach every PHP script under the manager HTML directory by appending '/login_admin.php' to any target script's path. The flaw stems from set_env.php trusting the client-controllable PHP_SELF value when deciding whether to skip authentication. Publicly available exploit code exists (KarmaInSecurity KIS-2026-14, reported by VulnCheck), but there is no CISA KEV listing, so treat it as no public active exploitation confirmed despite a ready POC.
Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.
Authentication bypass in Admidio's forum module before version 5.0.11 enables unauthenticated network-accessible attackers to read private forum topics and posts that administrators intended to restrict to logged-in members. The flaw stems from `modules/forum.php` failing to validate the login-only configuration state before serving content, meaning a direct HTTP request with read-only parameters is sufficient to circumvent the access gate. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, but the mechanistic simplicity of the bypass - a direct module access with no authentication - means exploitation requires minimal skill once a vulnerable, login-only-configured instance is located.
Arbitrary public static PHP method invocation in Grav CMS 2.0.7-2.0.10 allows any account holding page-editing rights (admin.pages) to read arbitrary server-readable files and create or copy files and directories under the web-server account. The flaw lies in Blueprint::isSafeDynamicCall(), which skips its dangerous-callable denylist entirely for strings containing '::' - meaning fully-qualified Class::method notation in blueprint dynamic-field directives is never checked against the blocklist. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis, but the low-privilege requirement and high-impact outcome make this a credible internal threat in multi-tenant or shared Grav deployments.
Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) allows unauthenticated attackers to upload arbitrary PHP files via a handler that fails to restrict uploaded file types, and those files are directly reachable and executable on the server. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 base score is 9.8, though the EPSS probability is low at 0.22% (13th percentile). This is a classic unauthenticated file-upload-to-RCE flaw that grants full server compromise with no authentication or user interaction.
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.
SQL injection in FastAdmin v1.6.1.20250430 lets remote attackers inject arbitrary SQL through the application/common/controller/Backend.php component, with the vendor advisory characterizing the impact as extending to arbitrary code execution. The flaw is tagged RCE/SQLi/PHP and carries a CVSS 9.8 rating with total technical impact per CISA's SSVC framework, though publicly available exploit code exists rather than confirmed active exploitation. EPSS is low (0.14%, 4th percentile), suggesting exploitation is not yet widespread despite the critical severity.
Unrestricted PHP file upload in the Theme Demo Import WordPress plugin (≤1.1.3) enables administrator-level users - including non-super-admin site admins on multisite installs - to bypass WordPress's native file-type validation and upload executable PHP files to the server's uploads directory, resulting in full remote code execution. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.14% (4th percentile), suggesting exploitation remains uncommon. No confirmed active exploitation in CISA KEV; however, SSVC rates technical impact as total.
Unrestricted PHP file upload in Everest Toolkit (WordPress plugin ≤1.2.3) enables authenticated Administrators - including non-super-admin site administrators on multisite networks - to place executable PHP web shells in the wp-content/uploads directory via the demo-content import feature. Full remote code execution on the underlying web server is achievable upon requesting the uploaded file. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), indicating this remains a targeted rather than widespread threat despite total technical impact.
Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical).
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with media upload permissions via a multi-segment filename bypass (e.g., shell.php.any.jpg) that defeats the extension blocklist in rex_mediapool::isAllowedExtension. The flaw is a confirmed regression introduced in PR #6213 (February 2025), which replaced a historically correct str_contains guard with weaker str_ends_with logic, reintroducing a double-extension attack class that the codebase had explicitly defended against since 2018. Exploitation additionally requires the target server to run a multi-extension PHP handler (Apache mod_mime AddHandler or unanchored FilesMatch); no public exploit or CISA KEV listing has been identified at time of analysis, and the vendor-released fix is available in version 5.21.1.
SQL injection in PHP Jabbers PHP Poll Script (versions prior to 4.1) allows an authenticated attacker with administrative access to inject arbitrary SQL through the pjAdminPolls.controller.php endpoint, where user-supplied input is not properly neutralized before being used in database queries. Successful exploitation can expose or modify poll and backend database contents (CVSS 4.0 base 8.6, high confidentiality/integrity impact). There is no public exploit identified at time of analysis and no active-exploitation (KEV) listing; the fix landed in version 4.1.
Remote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated administrator to inject arbitrary PHP code into server-side execution by crafting a malicious custom widget definition. The plugin writes this definition verbatim into a generated PHP file and subsequently executes it without sanitization. The critical escalation scenario occurs on WordPress multisite networks, where a subsite Administrator - ordinarily barred from file or code editing - can exploit this flaw to achieve host-level code execution, bypassing the privilege boundaries the network enforces. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.
Unauthenticated file upload validation bypass in the CodeIgniter4 PHP framework (versions prior to 4.7.4) lets a remote attacker upload executable PHP content by exploiting that the is_image and mime_in strict validation rules never enforced a safe client-supplied filename extension. Applications are affected only when they validate uploads solely with is_image or mime_in (without an independent extension check such as ext_in), persist files under the attacker-controlled client filename, and store them in a web-accessible, script-enabled directory. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list; the upstream fix (commit b6e9a4f, released as v4.7.4) adds client-extension consistency checks.
Path traversal file write in the CodeIgniter4 PHP framework prior to 4.7.4 lets remote unauthenticated attackers place uploaded files outside the intended directory whenever an application calls UploadedFile::move() without an explicit second (name) argument. Because the default used the raw client-supplied filename, traversal sequences such as '../../public/shell.php' could drop attacker-controlled content into web-accessible or sensitive locations, potentially enabling code execution on affected sites. No public exploit identified at time of analysis, though the fixing commit ships a regression test that concretely demonstrates the traversal payload.
SQL injection in CodeIgniter4's Query Builder deleteBatch() method (versions 4.3.0 through 4.7.3) allows user-controlled where() condition values to be interpreted as executable SQL because bound values are substituted into the generated DELETE statement while their escape flags are ignored. Only the deleteBatch() batch-delete path is affected; ordinary delete() operations escape their binds correctly. No public exploit was identified at time of analysis, and the flaw is resolved in version 4.7.4.
Privilege escalation via authorization bypass in Wolf CMS (through 0.8.3.1) lets any authenticated non-administrative user reach the BackupRestoreController and create, download, and restore site backups that should be admin-only. The root cause is a PHP operator-precedence mistake in the permission-check expression, so the access control evaluates incorrectly and grants low-privileged accounts admin-tier backup functionality. Publicly available exploit code exists (published by VulnCheck), but there is no public exploit identified in CISA KEV, so active exploitation is not confirmed.
Remote code execution in Wolf CMS through version 0.8.3.1 allows authenticated attackers holding the file_manager_mkfile capability to write arbitrary PHP files into the web-accessible FILES_DIR and execute them by requesting the file over HTTP. The flaw stems from missing file-extension validation in the FileManagerController create_file() and save() functions (CWE-434). Publicly available exploit code exists (via VulnCheck advisory), though it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in the session of any logged-in user because the Laravel VerifyCsrfToken middleware was commented out of the global middleware stack in HttpKernel.php, leaving every POST/PUT/DELETE endpoint token-free. A victim who is authenticated and visits an attacker-controlled page can be forced to create or delete projects, alter settings, and change permissions. Publicly available exploit code exists (GHSA-x8vx-9g5w-w5rr) and the flaw was reported by VulnCheck, though there is no public exploit identified as actively exploited (not in CISA KEV); EPSS was not provided.
Server-side request forgery in Kanboard 1.2.52 and earlier lets authenticated users pivot into internal networks by encoding target IP addresses in hexadecimal notation, which slips past the application's SSRF allow-list check. Because the isPrivateURL() filter in app/Core/Http/Client.php relies on FILTER_VALIDATE_IP - which rejects non-dotted-decimal formats - a hex-encoded address like 0x7f000001 is deemed 'not a private IP' and forwarded to cURL, which happily resolves and connects to it. Publicly available exploit code exists (a proof-of-concept gist), though there is no public exploit identified as being used in active attacks; EPSS was not provided.
Second-order PHP code execution in e107 CMS before version 2.3.8 lets an attacker who already holds out-of-band write access to the database plant a crafted payload in the user_prefs column, which is later fed to eval() when that user's preferences load. The e_array::unserialize() handler validates only that the stored string begins with 'array' before evaluating it, so any account whose preferences are materialized triggers arbitrary PHP execution. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds write in PHP's BCMath bccomp() function allows attacker-controlled inputs to corrupt stack and heap memory in PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9, with high confidentiality, integrity, and availability impact per the vendor CVSS 4.0 score of 8.1. Exploitation requires an application to pass attacker-influenced values into bccomp() with the BCMath extension enabled; there is no public exploit identified at time of analysis (CVSS E:U, no KEV listing). Memory corruption of this class can lead to crashes and, potentially, arbitrary code execution within the PHP process.
SQL injection in the PHP interpreter's string-escaping routine affects PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9, where backslashes in attacker-controlled parameters are improperly escaped, allowing malicious input to break out of quoted SQL string literals. Any web application relying on PHP's built-in escaping to sanitize user data before database queries can be subverted, enabling trivial injection. This is a CWE-89 flaw reported by the PHP project (advisory GHSA-7qpv-r5mr-78m4); no public exploit identified at time of analysis, and CVSS 4.0 rates it 8.1 with exploitation marked automatable.
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.
PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users with subscriber-level access or higher to deserialize attacker-controlled data through XProfile textbox fields, which can escalate to remote code execution when a usable POP gadget chain exists in the WordPress stack. The flaw stems from bp_unserialize_profile_field() calling @unserialize() on user-supplied profile data without the allowed_classes safeguard. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the moderate CVSS of 7.5 reflects the dependency on an available gadget chain (high attack complexity).
OS command injection in dnsmgr version 2.15 and earlier lets an attacker execute arbitrary commands through the ping function in CheckUils.php, which passes unsanitized input into a system shell call (CWE-77). SSVC rates the technical impact as total and marks exploitation as proof-of-concept, so publicly available exploit code exists, though it is not on CISA KEV and EPSS is low (0.15%). The published CVSS is 9.8, but note the description characterizes the attacker as 'local' while the CVSS vector encodes AV:N - this discrepancy affects real-world exposure and should be resolved against the target deployment.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
Remote code execution in the Aimy Captcha-Less Form Guard plugin for Joomla (versions 18.0 through 20.0) allows unauthenticated attackers to run arbitrary PHP by submitting a forged 'clfgd' form field that the plugin deserializes, triggering PHP object injection. Any unpatched Joomla site running this plugin is exposed to full server compromise over the network without authentication or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CWE-502 root cause and maximal CVSS 4.0 score (10.0) make this a critical-priority issue.
Remote code execution in the StyleMixThemes Cost Calculator Builder PRO WordPress plugin (versions up to and including 4.0.3) lets unauthenticated attackers run arbitrary PHP on the server by injecting non-word XOR gadgets into the orderDetails[*].originalValue field, which is passed verbatim into a PHP eval() call inside js_to_php(). The only gate is a nonce, but that nonce is printed on every front-end page via wp_head, so any anonymous visitor can retrieve it, effectively removing the authentication barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.8 rating and trivial nonce bypass make this a high-priority, pre-authentication server-takeover flaw.
Arbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full server compromise by uploading a malicious SCORM package containing a PHP webshell. The uploaded file is placed in a publicly accessible directory, enabling the attacker to execute arbitrary commands on the underlying server. No evidence of active exploitation or public exploit code exists at this time, but the CVSS score of 9.9 reflects critical severity.
Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.
We are tasked with synthesizing a comprehensive analysis about CVE-2026-66745 from multiple sources, outputting a plain-text JSON. Let's go through each field. First, understand the CVE: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) has a session fixation vulnerability. Unauthenticated attackers can set a known PHPSESSID on a victim's browser before authentication, and when the victim authenticates via fw.login.php, the attacker gains administrative session on port 9000. CVSS 4.0 vector given: AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-94 (Code Injection) is listed, but that seems odd for session fixation; maybe it's misattributed? But we'll use provided data. Tags: RCE, PHP, Code Injection, Artica Proxy. RCE? Session fixation doesn't give RCE directly; maybe there's more to it? Description only mentions session fixation leading to admin session hijack. Might be an error in tags. We'll stay factual. CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:* (all versions pre-fix). Patch: Available, with hotfix version 20260724-02 (provided). References: Articatech wiki, hotfixes page, VulnCheck advisory. Now we need to fill fields. product_name: "Artica Proxy" - that's the product, matches CPE. Only 1-3 words. Yes. summary: Start with specific impact verb and product. Not "A vulnerability..." So: "Administrative session hijacking in Artica Proxy before 4.50.000000 SP7 allows unauthenticated attackers to pre-set a session ID on a victim's browser, then wait for the victim to authenticate via fw.login.php, gaining full administrative control on port 9000. The vulnerability is a session fixation flaw with a CVSS 4.0 base score of 7.5. No exploitation evidence (KEV) or public POC is currently confirmed, but a hotfix is available." It says "session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions", so impact is administrative session hijack. So summary: "Administrative session h
Privilege escalation in Pterodactyl Wings allows authenticated subusers to upload arbitrary files without the required file.create permission by reusing lower-privilege panel-signed JWTs (e.g., from websocket authentication or file downloads). A public proof-of-concept demonstrates how a subuser with only websocket.connect can upload files to the server, potentially compromising its container. Patches introduce JWT scoping in Panel 1.12.3 and Wings 1.12.2.
Authentication denial of service in Pterodactyl Panel 1.7.0–1.12.4 allows an unauthenticated remote attacker to lock out all users from login and two-factor authentication by exhausting a single shared rate-limit bucket with approximately 10 requests per minute. The attacker can sustain the lockout indefinitely, preventing legitimate access including administrative login. A proof-of-concept is publicly available, though no active exploitation has been reported via CISA KEV.
Arbitrary command execution in WordPress Coding Standards (WordPressCS) before 3.4.1 lets attacker-controlled PHP source trigger code execution on the machine running the linter. The flawed WordPress.WP.EnqueuedResourceParameters sniff reconstructed the $ver argument of wp_enqueue_script()/wp_register_script() and passed it to eval(), so scanning a malicious file (for example a pull request in CI) with the WordPress or WordPress-Extra rulesets runs the attacker's payload. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the technical impact is total and a patched release (3.4.1) is available.
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privileges by injecting forged identity headers that upstream applications may trust. The oauth-proxy fails to strip underscore-variant headers, enabling WSGI and PHP frameworks to normalize them into the legitimate identity, potentially overriding the true authenticated user. No known active exploitation or public exploit code has been identified.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Remote code execution in phpMyFAQ before version 4.1.6 allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files to the server. By uploading a malicious ZIP file as an attachment and then manipulating the upgrade.lastDownloadedPackage configuration setting to point to that file, an attacker can extract attacker-controlled PHP code into the web root, leading to code execution as the web server user. No known public exploit code or active exploitation has been reported at the time of this analysis.
Path traversal in phpMyFAQ's category image deletion allows authenticated attackers to delete arbitrary files, leading to superadmin account creation. Versions before 4.1.6 fail to sanitize the existing_image parameter, permitting deletion of critical files like database.php, which disables the installation gate and exposes the setup wizard. Publicly available exploit code exists, and the issue has been verified by the vendor.
Remote code execution in vBulletin 5.x and 6.x allows unauthenticated attackers to execute arbitrary PHP code via a crafted request to the ajax/render endpoint. The vulnerability resides in the vB5_Template_Runtime::runMaths() method, where an insufficient regex filter can be bypassed using phpfuck-style encoding to inject and evaluate arbitrary PHP. Publicly available exploit code exists, and no CISA KEV listing was identified at the time of analysis, but the lack of authentication makes unpatched instances critically exposed.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
Information disclosure in Dede CMS 5.7.118 allows remote unauthenticated attackers to retrieve sensitive data via the 'str' parameter in the file_manage_control.php component. No active exploitation has been confirmed, but a public write-up with exploit details is available on a Gitee repository.
SQL injection in Dede CMS 5.7.118 via the sqlquery parameter of sys_sql_query.php allows unauthenticated remote attackers to extract arbitrary database contents, including sensitive information. A publicly available proof-of-concept exploit exists, although no active exploitation has been confirmed.
An authenticated PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress (versions ≤6.2.6) allows a user with Subscriber-level privileges to inject a malicious serialized PHP object via deserialization of untrusted input. If a suitable POP chain is present and the user update integration is enabled with a mapped user meta field, the attacker can change user passwords and ultimately take over administrator accounts. Public exploit code is available, but the EPSS score (0.38%) suggests low real-world exploitation probability and the vulnerability is not listed in CISA's KEV.
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger infinite loops when processing malformed varint input, affecting Python, Go, PHP, and Java bindings before version 0.24.0. Exploitation can exhaust CPU resources, making the service unresponsive; no active exploitation or public exploit code is known at this time.
Authenticated SQL injection in Likeshop up to 3.0.5 allows admin-level users to extract arbitrary database contents via the adjustAccount endpoint. The vulnerability stems from unsanitized POST parameters (money, integral, growth, earnings) concatenated directly into raw SQL queries. Exploit code is publicly available, though no active exploitation has been reported by CISA.
Denial of service in PhpSpreadsheet (PHPOffice) versions 2.0.0 through 5.8.0 lets remote unauthenticated attackers crash a PHP worker with a ~1 KiB malformed XLS/OLE file. The library's OLERead::read() follows attacker-controlled OLE sector chains without cycle detection, so a sector that points back to itself makes the small-block depot loop append the same data until memory is exhausted. It is triggered during automatic format detection via Reader\Xls::canRead(), so any app that probes untrusted spreadsheet uploads is affected; a working proof of concept is published in the vendor advisory, though the flaw is not in CISA KEV.
Denial-of-service in PhpSpreadsheet's Gnumeric reader lets remote attackers crash PHP worker processes by uploading a tiny gzip-compressed .gnumeric file that decompresses to hundreds of megabytes. The reader's Gnumeric::canRead() calls gzdecode() with no decompressed-size cap during routine file-type detection, so a ~98 KB payload expanding to ~96 MiB exhausts a 64M memory limit and triggers a fatal error before validation. No public exploit is identified at time of analysis, but a working proof-of-concept is described in the advisory and the CVSS score is 7.5 (High) with A:H impact.
Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.