tag
Php
PHP bcmath bccomp() Out-of-Bounds Write (CVE-2026-17544)
CVE-2026-17544 is an out-of-bounds write vulnerability in the PHP bcmath extension, specifically in the bcstr2num() function in ext/bcmath/libbcmath/src/str2num.c. When the manual scale is smaller than the auto scale, the fraction is truncated and a…
Unauthenticated Arbitrary File Upload RCE in iCagenda for Joomla (CVE-2026-48939)
iCagenda's frontend event-registration form includes an optional file-attachment field. The "Registered Only" access restriction meant to gate that field is enforced only in the view layer that decides whether to render the form — the registration.submit…
WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057)
WavePlayer, a WordPress audio player plugin, exposes an AJAX action (wvpl-ajax=createlocalcopy) that lets an unauthenticated visitor instruct the server to fetch a remote URL and save it as a local "track" file inside the uploads directory, without validating…
ThinkPHP 5.0.24 File Inclusion Leading to Remote Code Execution (CVE-2025-63888)
ThinkPHP 5.0.24's read() method in thinkphp/library/think/template/driver/File.php fails to validate the template path derived from user-controlled input passed to the framework's view() function. By submitting a crafted template parameter (e.g. a…
Roundcube Webmail Post-Auth RCE via PHP Object Deserialization (CVE-2025-49113)
Roundcube Webmail versions up to and including 1.6.10 are vulnerable to a post-authentication PHP object deserialization vulnerability in the file upload handler, which passes a client-supplied attachment filename through a deserialization path without…
Pterodactyl Panel Unauthenticated Path Traversal via locale.json Leaking Database Credentials (CVE-2025-49132)
Pterodactyl Panel prior to version 1.11.11 exposes a /locales/locale.json endpoint that accepts attacker-controlled locale and namespace query parameters without a required integrity/hash check, allowing an unauthenticated attacker to traverse outside the…
PPOM for WooCommerce <= 33.0.15 - Unauthenticated Time-Based Blind SQL Injection (CVE-2025-11391)
The "PPOM for WooCommerce" plugin (WooCommerce Product Addon / PPOM Fields) is vulnerable to an unauthenticated time-based blind SQL injection in its getproductmeta() function, present in versions up to and including 33.0.15. The function concatenates a…
Monsta FTP Pre-Authentication Remote Code Execution via Arbitrary File Upload (CVE-2025-34299)
Monsta FTP versions up to and including 2.11.2 contain a pre-authentication, unrestricted arbitrary file upload vulnerability (CWE-434) in the downloadFile action of its /mftp/application/api/api.php endpoint. The endpoint accepts a user-supplied FTP…
Laravel Livewire Remote Code Execution via Known APP_KEY (CVE-2025-54068)
Laravel Livewire serializes component state into a wire:snapshot HTML attribute and protects it with an HMAC-SHA256 checksum keyed on the application's APPKEY. If an attacker obtains the APPKEY (leaked .env, default/demo key, weak secret, etc.), they can…
Laravel `files.*` Wildcard Validation Bypass via Polyglot JPEG+PHP Upload (CVE-2025-27515)
CVE-2025-27515 is a file upload validation bypass (CWE-20: Improper Input Validation) affecting Laravel applications that validate array-based file uploads with wildcard rules such as files.. The root cause is that Laravel's mimes: validation rule inspects…
Kubio AI Page Builder <= 2.5.1 Unauthenticated Local File Inclusion (CVE-2025-2294)
The Kubio AI Page Builder plugin for WordPress, in all versions up to and including 2.5.1, is vulnerable to Local File Inclusion via the kubiohybridthemeloadtemplate function. The root cause is that a template path supplied through a query-string parameter is…
Invision Community Theme Editor Template Injection Unauthenticated RCE (CVE-2025-47916)
Invision Community's theme editor exposes a customCss() action on the front-end themeeditor controller (/applications/core/modules/front/system/themeeditor.php) that is reachable without authentication and passes the attacker-supplied content request…
GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)
CVE-2025-22777 is an unauthenticated PHP Object Injection (CWE-502, Deserialization of Untrusted Data) vulnerability in the GiveWP WordPress donation plugin. GiveWP stores certain donor-supplied form field values as serialized PHP meta in the database and…
"Grocery" PHP Application `search_products_itname.php` `sitem_name` Boolean-Based SQL Injection (CVE-2025-65354)
The target is a PHP "Grocery" web application whose product-search endpoint, Grocery/searchproductsitname.php, takes a sitemname parameter that is concatenated into a backend SQL query without parameterization or escaping. This allows classic boolean-based…
ZoneMinder — Second-Order SQL Injection via Event Rename (CVE-2026-27470)
ZoneMinder's event-rename functionality (web/ajax/event.php) safely stores a user-supplied event name using a parameterized query, giving no indication anything is wrong. However, the "near events" lookup (web/ajax/status.php, getNearEvents()) later reads…
Xboard / V2Board — Magic Link Token Leak Unauth Account Takeover (CVE-2026-39912)
Both V2Board and its fork Xboard implement a "login with mail link" (magic link) feature. Their loginWithMailLink endpoint (AuthController.php in V2Board, MailLinkService.php in Xboard) generates the one-time login link and is supposed to only deliver it via…
WordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180
The Contest Gallery WordPress plugin passes the cglmaili parameter through WordPress's sanitizeemail() function, which preserves the single-quote character (') in the local part of an email address. Because the sanitized value is subsequently used to build a…
WeGIA Authenticated Error-Based SQL Injection Exploitation Helper (CVE-2026-23723)
WeGIA's control.php endpoint (AtendidoocorrenciaControle::listarTodosComAnexo) is vulnerable to authenticated error-based SQL injection through the idmemorando parameter. This helper script automates the tedious part of exploitation: it attempts login against…
Visitor Management System 1.0 — Unrestricted File Upload to RCE (CVE-2026-37748)
Visitor Management System 1.0 calls moveuploadedfile() in vms/php/adminuserinsert.php and vms/php/update1.php without validating the uploaded file's MIME type, extension, or content. An authenticated admin user can upload a PHP webshell disguised as a profile…
Veno File Manager 4.4.9 — Unauthenticated LFI to Superadmin Takeover (CVE-2026-37072)
admin-head-updates.php in Veno File Manager 4.4.9 is vulnerable to Local File Inclusion via the unsanitized lang GET parameter. An unauthenticated attacker can send a crafted POST request with a path-traversal payload in lang that corrupts the application's…
Veno File Manager 4.4.9 — Authenticated Arbitrary File Read (CVE-2026-37070)
Veno File Manager 4.4.9 exposes the /vfm-admin/ajax/streamvid.php endpoint without properly restricting which files a session-authenticated user may request. A user who is only supposed to have access to their own assigned directory can instead read any…
Veno File Manager 4.4.9 — Arbitrary File Rename to Privilege Escalation (CVE-2026-37071)
Veno File Manager 4.4.9's Actions::renameFile() function fails to restrict which files an authenticated user with rename permission can rename. By renaming the application's own vfm-admin/config.php file, an attacker triggers the application into believing it…
Shopware Twig Rendered-View Code Injection Regression (CVE-2026-23498)
Shopware previously fixed CVE-2023-2017 by restricting Twig filters so that only allow-listed functions could be invoked from templates. CVE-2026-23498 is a regression of that fix: the allow-list check was not applied to array- and closure-crafted values…
School Management System 1.0 — Reflected XSS in register.php (CVE-2026-37750)
register.php in School Management System 1.0 reflects the type request parameter into the page's HTML twice — once inside an <h1> tag via ucfirst($REQUEST['type']) and once inside a form action attribute — without applying htmlspecialchars() or any output…
Responsive Filemanager 9.14.0 — Unauthenticated RCE via Duplicate File (CVE-2026-39023)
Responsive Filemanager 9.14.0 allows an unauthenticated attacker to abuse its "duplicate file" functionality to create a new file with an attacker-chosen name and PHP extension containing arbitrary content. By duplicating an existing file into a .php file…
OpenXDMoD `user_interface.php` Report Title Command Injection (CVE-2026-45777)
Open XDMoD's controllers/userinterface.php endpoint accepts a report title parameter as part of a PDF report generation request. The PoC demonstrates that this value is passed unsanitized into a server-side command execution context (used during PDF/report…
OpenSTAManager Scadenzario Bulk Operations Error-Based SQL Injection — CVE-2026-24418
OpenSTAManager's bulk-operations handler for the Scadenzario (payment schedule) module accepts an idrecords[] array via POST at /actions.php?idmodule=18. The arrayclean() helper only strips empty values and never validates that elements are integers, so…
OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)
OpenSTAManager fails to sanitize the righe GET parameter before reflecting it into a hidden HTML input's value attribute across six modificaiva.php modal files (contracts, quotes, invoices, DDT, orders, and interventions modules). Because the parameter is…
OpenSTAManager Prima Nota Error-Based SQL Injection — CVE-2026-24419
The Prima Nota (journal entry) module's add.php reads the iddocumenti GET parameter, splits it on commas with explode(), but never validates that the resulting elements are integers before imploding them back into a SQL IN() clause used to look up…
OpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417
OpenSTAManager's global search AJAX endpoint (/ajaxsearch.php) dispatches the user-supplied term parameter to more than ten module-specific search handlers (Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, and others), each of which…
OpenSTAManager Article Pricing Time-Based Blind SQL Injection — CVE-2026-24416
OpenSTAManager's article pricing AJAX handler (/ajaxcomplete.php?op=getprezzi) builds a UNION SQL query to pull pricing history from invoices and delivery notes. The developer correctly wrapped the idarticolo parameter in the framework's prepare() sanitizer…
OpenEMR EtherFax Module Authenticated Arbitrary File Read (CVE-2026-24849)
OpenEMR's Fax/SMS module ships an EtherFax integration whose disposeDoc() handler (in EtherFaxActions.php) takes an attacker-controlled filepath request parameter, checks only that the file exists, and passes it directly to readfile() with no canonicalization…
Mercator Configuration SSRF Chained to Internal Redis RCE (CVE-2026-49345)
This repository contains two Python PoCs that abuse an unvalidated provider URL parameter in Mercator's ConfigurationController::testProvider endpoint, which the server fetches with libcurl. ssrf2scan.py uses the telnet:// scheme to turn the SSRF into a blind…
MantisBT SOAP `mc_issue_add` Authentication Bypass (Type Juggling) — CVE-2026-30849
MantisBT's legacy SOAP API is affected by a PHP loose-comparison ("type juggling") flaw in password verification reachable via the mcissueadd SOAP operation, allowing an attacker to authenticate without knowing a valid password by supplying a specially…
Joomla Novarain Framework (nrframework) Unauthenticated Arbitrary File Inclusion — CVE-2026-21627
The ajaxTaskInclude() method of the nrframework Joomla plugin is explicitly whitelisted for unauthenticated frontend AJAX access and accepts attacker-controlled path, file, and class parameters. The path parameter uses Joomla's RAW input filter (no…
InvoicePlane Unauthenticated Path Traversal in Guest Controller (CVE-2026-23491)
InvoicePlane v1.6.3's Guest module exposes a getfile controller action that serves uploaded customer files. The action urldecode()s the requested filename and concatenates it directly onto a fixed base directory (uploads/customerfiles/) before passing the…
HAXcms Git.php OS Command Injection (CVE-2026-46394)
HAXcms's Git.php library builds shell command strings by concatenating unsanitized parameters and executes them via procopen(). Of the 17 functions that shell out, only commit() escapes its input with escapeshellarg() — the remaining 15, including…
Group-Office PHP Deserialization Remote Code Execution (CVE-2026-34838)
CVE-2026-34838 is a PHP object deserialization vulnerability in Group-Office. The AbstractSettingsCollection::loadData() method calls unserialize() on a stored setting value prefixed with serialized:, without validating the object type. By storing a crafted…
Gravity Forms Path Traversal → Arbitrary File Deletion (CVE-2026-48866)
Gravity Forms stores the URL of uploaded files in a form entry via the gformuploadedfiles parameter without stripping ../ sequences (escurlraw() and isvalidurl() both accept path-traversal payloads). When an entry containing such a URL is later deleted —…
FOSSBilling Unauthenticated API Key Config Disclosure & Password Reset Token Reuse — CVE-2026-53647
CVE-2026-53647 is an unauthenticated information disclosure vulnerability in FOSSBilling's guest API. The endpoint /api/guest/serviceapikey/getinfo returns the full service configuration — including custom fields, API credentials, internal hostnames, and…
Dolibarr selectobject.php Authenticated Local File Inclusion (CVE-2026-34036)
Dolibarr's core/ajax/selectobject.php endpoint, used to power object-picker autocomplete widgets in the UI, accepts an objectdesc parameter that is used to build a path to a local file. An authenticated user can craft an objectdesc value (in the form…
Dolibarr ERP/CRM OS Command Injection via MAIN_ODT_AS_PDF (CVE-2026-23500)
Dolibarr's ODT-to-PDF document conversion feature builds a shell command by concatenating the admin-configurable MAINODTASPDF global setting with a sanitized filename before passing it to PHP's exec(). While the filename argument is escaped with…
diskover-community — CSRF Leading to Authentication Bypass (CVE-2026-38934)
public/settingsprocess.php in diskover-community (<= 2.3.5) accepts sensitive configuration-changing POST requests without validating any CSRF token. An attacker can craft a self-submitting HTML form that, when opened by an authenticated administrator,…
Discuz! X5.0 Race Condition + CAPTCHA-Solving Pre-Auth to RCE Chain (CVE-2026-49952)
This is a multi-stage, pre-auth-to-RCE exploit chain against Discuz! X5.0 that combines several bugs: an authcode-based DB export/import feature is abused to leak the admin's username and MD5 password hash from a database backup; the exploit then registers a…
dedoc/scramble Laravel API-Doc Generator Unauthenticated eval() RCE (CVE-2026-44262)
dedoc/scramble generates OpenAPI documentation for Laravel APIs by statically analyzing controller code, including validation rules. Its NodeRulesEvaluator::doEvaluateExpression() routine calls PHP's extract($variables) immediately before eval("return…
CodeAstro Simple Attendance Management System 1.0 — SQL Injection Auth Bypass (CVE-2026-37749)
The login form in index.php of CodeAstro Simple Attendance Management System 1.0 concatenates the username POST parameter directly into a MySQL query with no sanitization or prepared statements. An unauthenticated attacker can submit a classic SQL injection…
Chamilo LMS Unauthenticated install.ajax.php SSRF + Open Mail Relay — CVE-2026-33715
Chamilo LMS ships an installation-wizard AJAX endpoint, public/main/inc/ajax/install.ajax.php, that unlike every other AJAX endpoint in the codebase never includes global.inc.php — the file responsible for enforcing session/authentication checks — and remains…
Centreon Multi-Vector RCE — Path Traversal, Command Injection & Blind SQLi (CVE-2026-2749)
This repository bundles three distinct, authenticated vulnerabilities in Centreon that were disclosed together. CVE-2026-2749 is a path traversal flaw in the Open Tickets upload feature that allows arbitrary file write, which can be escalated to remote code…
BoidCMS — Authenticated File Upload to RCE via Template Injection (CVE-2026-39387)
BoidCMS (<= 2.1.2) combines two weaknesses to reach remote code execution from an authenticated admin account. First, its media upload endpoint only checks the declared MIME type (e.g. image/gif) rather than actual file contents, allowing PHP code embedded in…
Bludit CMS API Unrestricted File Upload to RCE (CVE-2026-25099)
Bludit CMS's POST /api/files/<page-key> endpoint lets any holder of a valid API token upload files to a page without validating file extension or content, so a PHP file can be uploaded and dropped directly under the web-accessible uploads directory. Once…
Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415
Before Azuriom 1.2.11, the admin panel's server-management routes (/admin/servers/) had no dedicated permission gate — any admin-panel user with just the base admin.access permission could reach them, since the admin.servers permission did not exist yet.…
AdminPanel 4.0 CSRF File Deletion / Setup-Mode Reset — CVE-2026-30498
AdminPanel 4.0's delete.php endpoint performs a sensitive file-deletion action (deleting verifyPanel.php) via a simple GET request, with no CSRF token, no Origin/Referer validation, and no confirmation of user intent. An attacker can host a page that…
PHP 8.5.7 StreamBucket-to-SOAP Numeric Cookie Remote Code Execution
This PoC demonstrates a full memory-corruption-to-RCE chain in PHP 8.5.7 built from three engine/extension behaviors chained together: ArrayIterator can mutate normally-protected internal object properties (bypassing typed-property/visibility/readonly…
MyBB 1.8.40 Limited Admin CP User-Manager to Full Administrator Privilege Escalation
A non-super Admin CP account that has only the user-management permission (user-users = 1) can use the standard Admin CP "add user" form to create a brand-new account directly in the Administrator group (gid=4), because the underlying user data handler's…