#Web Security
All CosmicBytez Labs articles tagged #Web Security, across news, security advisories, how-to guides, and projects.
- Security
Critical Auth Bypass in DevKit Pro Lets Unauthenticated Attackers Take Over WordPress Admin Accounts
Critical CVSS 9.8 auth bypass in DevKit Pro (≤2.3.0) lets unauthenticated attackers forge a cookie and take over any WordPress administrator account.
- Security
Critical Auth Bypass in Divi Membership Lets Attackers Log In as Any User
CVE-2026-19660 (CVSS 9.8): a forged paypal_param GET request lets unauthenticated attackers log in as any WordPress user, including admins.
- Security
CVE-2026-102908: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System
SourceCodester Online Reviewer Management System v1.0's questions-view.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93973: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System (Subject Module)
Online Reviewer Management System v1.0's subject btn_functions.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93974: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System (Databank Module)
Online Reviewer Management System v1.0's databank btn_functions.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93997: Unauthenticated SQL Injection in SourceCodester Drug Recommendation System
Drug Recommendation System v1.0's edit_symptom.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
Photo Gallery WordPress Plugin Flaw Allows Arbitrary File Upload
A loop-counter bug in the Photo Gallery, Sliders, Proofing & Themes plugin lets gallery managers bypass archive extension checks and run code.
- Security
CVE-2026-93959: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System
Online Reviewer Management System v1.0's btn_functions.php lets remote, unauthenticated attackers inject SQL via the Course parameter. PoC public.
- Security
Gravity Forms Unauthenticated File Upload Lets Attackers Achieve RCE
CVE-2026-84434 (CVSS 9.8) lets unauthenticated attackers bypass Gravity Forms' hidden-field validation to upload executable files. Patch now.
- Security
WP Photo Album Plus RCE Lets Subscribers Hijack ImageMagick Commands
CVE-2026-87909 (CVSS 7.5) lets Subscriber-level WordPress users achieve RCE in WP Photo Album Plus via unsanitized filenames passed to ImageMagick.
- Security
WP Recipe Maker Flaw Lets Attackers Run Shortcodes via Recipe Ratings
CVE-2026-89274 (CVSS 9.1) in WP Recipe Maker lets unauthenticated attackers trigger server-side shortcode execution through approved rating comments.
- Security
Forminator Forms Bug Lets Attackers Run Shortcodes via Quiz Parameter
CVE-2026-92229 (CVSS 9.1) in Forminator Forms lets unauthenticated attackers execute arbitrary shortcodes by abusing the quiz current_url parameter.
- Security
Critical RCE in AF Companion WordPress Plugin (CVE-2026-84738)
AF Companion before 2.2.0 lets low-privileged store-management users upload arbitrary PHP files, enabling full remote code execution.
- Security
SQL Injection in SourceCodester School Registration and Fee System 1.0
CVE-2026-90514 lets unauthenticated remote attackers inject SQL via the Status parameter in save_stud.php, with a public PoC exploit already live.
- Security
Mass Assignment Flaw in MemberPress Corporate Accounts Enables Admin Takeover
CVE-2026-15451 lets a corporate sub-account holder create rogue WordPress admins or hijack existing ones via unfiltered mass assignment.
- Security
Privilege Escalation in User Registration & Membership ≤ 5.2.7
CVE-2026-80071 lets Author-level WordPress users self-assign an arbitrary membership plan and escalate straight to Administrator.
- Security
CVE-2026-86406: User Registration & Membership Purchase Flaw Lets Any Subscriber Escalate to Administrator
A missing capability check in User Registration & Membership's purchase flow lets any Subscriber claim an Administrator-mapped plan for free.
- Security
SQL Injection in Feng Office ≤ 3.11.13.11 Legacy API
CVE-2026-90495 lets remote attackers inject SQL via the auth parameter of Feng Office's Legacy API, with a public PoC exploit already circulating.
- Security
Missing Authorization in WWBN AVideo Exposes Scheduler Email Jobs
CVE-2026-90537 lets an attacker with a harvested daily token enumerate AVideo scheduler jobs, read private data, and trigger email sends.
- Security
Frontegg SAML SSO Plugin Flaw Lets Anyone Log In as WordPress Admin
CVE-2026-75800 lets unauthenticated attackers forge SAML responses and log in as any WordPress user, including administrators.
- Security
Code Monkeys Proposals Plugin Lets Any Subscriber Delete WordPress Files
CVE-2026-77005 allows low-privilege WordPress users to delete arbitrary server files, including wp-config.php, enabling full site takeover.
- Security
WebTotem Backups Plugin Lets Any Subscriber Delete WordPress Files
CVE-2026-77006 lets low-privilege WordPress users delete arbitrary server files after the plugin discards its own CSRF check result.
- Security
CSRF-to-RCE File Upload Flaw in Gpx2Graphics Plugin
CVE-2026-81090 lets attackers trick a logged-in WordPress admin into uploading a PHP webshell through the Gpx2Graphics plugin.
- Security
DS Ad Rotator Plugin Flaw Allows Unauthenticated RCE on WordPress
CVE-2026-81402 lets unauthenticated attackers upload arbitrary PHP files through the DS Ad Rotator plugin's unprotected image upload handler.
- Security
Masteriyo LMS Deserialization Flaw Lets Low-Privilege Users Hit RCE
CVE-2026-82845 lets minimal-account WordPress users inject PHP objects through Masteriyo LMS metadata and achieve remote code execution.
- Security
Unauthenticated SQL Injection Hits SourceCodester Online Voting System
CVE-2026-86290: an unauthenticated SQL injection in SourceCodester's Online Voting System via ajax.php's Category parameter, PoC public.
- Security
SQL Injection in SourceCodester Class & Exam Timetabling System
CVE-2026-86208: an unauthenticated SQL injection in delete_teacher.php lets remote attackers manipulate the ID parameter. Public exploit code exists.
- Security
Second SQL Injection Hits SourceCodester Timetabling System
CVE-2026-86209: SourceCodester's Class and Exam Timetabling System 1.0 has a second unauthenticated SQLi, this time in delete_user.php.
- Security
SQL Injection Hits SourceCodester Timetabling System Again
CVE-2026-86220: an unauthenticated SQLi in SourceCodester's Class and Exam Timetabling System lets attackers inject via modal_add_course.php.
- Security
Third SourceCodester Timetabling SQLi Hits the Admin Product Form
CVE-2026-86224: a pre-auth SQL injection in SourceCodester's Timetabling System admin panel via the fname parameter in modal_add_product.php.
- Security
Critical Unauthenticated Hook Injection in ComboBlocks WordPress Plugin
ComboBlocks (Post Grid and Gutenberg Blocks) versions 2.2.32-2.3.1 let unauthenticated attackers inject dynamic action hooks, risking full RCE.
- Security
Critical Auth Bypass in Frontend Admin Plugin Enables Full Account Takeover
A critical flaw in the Frontend Admin by DynamiApps WordPress plugin lets unauthenticated attackers hijack any account, including admins.
- Security
SQL Injection in SourceCodester Online Voting System Risks Election Data
An unauthenticated SQL injection in SourceCodester's Online Voting System lets attackers manipulate voter, admin, and configuration records.
- News
5,400+ Hacked Sites Serve ClickFix Payloads Stored on the Blockchain
Attackers stash ClickFix malware stagers in BNB Smart Chain smart contracts, giving compromised WordPress and PrestaShop sites takedown-resistant C2.
- Security
MStore API Plugin: Unauthenticated JWT Forgery Auth Bypass
Missing signature verification in MStore API's Firebase phone-auth handler lets attackers forge JWTs and impersonate any WordPress account.
- Security
Critical Unauthenticated RCE in Hummingbird WordPress Plugin
A namespace-resolution bug leaves Hummingbird's debug log web-accessible and unsanitized, letting unauthenticated attackers plant PHP via a cookie.
- Security
Critical LFI in Divi Ajax Filter Plugin Allows Unauthenticated PHP Execution
CVE-2026-11613 lets unauthenticated attackers include and execute arbitrary PHP files in the Divi Ajax Filter WordPress plugin (≤ 5.1.2).
- Security
Unauthenticated Privilege Escalation in Authorizer ≤ 3.15.1
CVE-2026-81294 (CVSS 9.8) lets unauthenticated attackers gain elevated privileges in the Authorizer WordPress login/SSO plugin.
- Security
CVE-2025-9314: Unauthenticated File Upload in Developer Tools WordPress Plugin
A critical, unauthenticated arbitrary file upload flaw in the Developer Tools plugin's bundled SWFUpload component allows full site takeover.
- Security
CVE-2026-4357: Maximum-Severity File Upload Flaw in Embed HTML5 Game Plugin
A perfect-10 CVSS unauthenticated file upload bug in the Embed HTML5 Game WordPress plugin lets attackers drop PHP backdoors with zero access.
- Security
CVE-2026-77009: Subscriber-to-RCE via Exposed Debug Console in WatchMan-Site7
A critical code injection flaw in WatchMan-Site7 lets any authenticated subscriber run arbitrary PHP through the plugin's unrestricted debug console.
- Security
Unauthenticated SQL Injection in WCFM Marketplace ≤ 3.8.1
A critical unauthenticated SQL injection (CVSS 9.3) in the WCFM Marketplace WordPress plugin exposes vendor and customer database records.
- Security
CVE-2026-82610: SQL Injection in itsourcecode Online Medicine Delivery System
An unauthenticated SQL injection in the employee login of itsourcecode's Online Medicine Delivery System 1.0 has a public exploit available.
- Security
Sigma Forms Pro WordPress Plugin: Unauthenticated RCE via File Upload (CVE-2026-14494)
CVE-2026-14494 (CVSS 9.8) lets unauthenticated attackers upload PHP webshells through Sigma Forms Pro's default form templates. No patch yet.
- Security
CVE-2026-32479: Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro
Critical unauthenticated SQL injection (CVSS 9.3) in the WordPress plugin Visitor Traffic Real Time Statistics Pro ≤ 11.17. Patch to 11.18.
- Security
CVE-2026-32566: Unauthenticated Privilege Escalation in ACPT (Pro) Custom Post Types Plugin
Critical unauthenticated privilege escalation (CVSS 9.8) in WordPress plugin ACPT (Pro) ≤ 2.0.63. No official patch yet — Patchstack has a mitigation rule.
- Security
Critical TranslatePress Flaw Exposes 400,000+ WordPress Sites to Account Takeover
CVE-2026-19632 leaks a plaintext admin password-reset key via an unauthenticated AJAX action in TranslatePress, enabling full site takeover.
- Security
CVE-2026-7808: justhtml HTML Sanitization Bypass (Critical XSS)
Critical XSS in justhtml before 1.16.0. Multiple bypass paths let dangerous content survive sanitization, enabling script injection with no auth required.
- Security
CVE-2026-78143: SQL Injection in Barangay Resident Profiling Management System
High-severity SQL injection in Barangay Resident Profiling System 1.0 lets remote attackers extract personal data via the residents.php Search parameter.
- Security
CVE-2026-5388: Critical XSS Sanitization Bypass in justhtml
justhtml before 1.15.0 has multiple sanitization failures allowing XSS bypass via URL helpers, HTML serialization, and Markdown passthrough.
- News
Critical Elementor Pro Bug Exposes WordPress Sites to RCE Attacks
CVE-2026-32475 (CVSS 9.0): Unauthenticated attackers can upload PHP webshells via a loop desync flaw in Elementor Pro's file upload field.
- Security
CVE-2026-53545: Termix SSH Tunnel Command Injection — CVSS 9.8 Critical
Critical OS command injection in Termix's SSH tunnel teardown lets authenticated attackers execute arbitrary OS commands on hosts. Patch to 2.3.2.
- Security
Critical Unauthenticated RCE in JetEngine WordPress Plugin (CVE-2026-66613)
A CVSS 9.8 unauthenticated remote code execution flaw in JetEngine plugin <= 3.8.14 lets attackers fully compromise WordPress sites.
- Security
Critical SQL Injection in Maps Marker Pro WordPress Plugin (CVE-2026-73183)
An unauthenticated SQL injection flaw (CVSS 9.3) in Maps Marker Pro <= 4.32 exposes WordPress databases to full read and write access.
- Security
CVE-2026-55674: Discourse Unauthenticated HTML Injection via Cookie
A CVSS 9.3 critical flaw in Discourse allows unauthenticated attackers to inject arbitrary HTML using a crafted cookie value.
- Security
CVE-2026-74800: SiYuan Stored XSS via Asset Upload Enables Full Kernel API Access
SiYuan before 3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers, enabling stored XSS with full kernel API access.
- Security
CVE-2026-14498: Query Wrangler WordPress Plugin Exposes Sites to RCE
A high-severity RCE flaw (CVSS 8.8) in the Query Wrangler WordPress plugin lets authenticated attackers inject and execute arbitrary PHP via a missing...
- Security
CVE-2026-14524: Critical Unauthenticated File Deletion in ProSolution WP Client
A CVSS 9.1 flaw in ProSolution WP Client lets unauthenticated attackers delete arbitrary files on WordPress servers, potentially wiping installations.
- Security
CVE-2026-15002: Stored XSS in Autopay WooCommerce Plugin for WordPress
CVE-2026-15002 is a stored XSS flaw (CVSS 7.2) in the Autopay WooCommerce plugin, letting attackers inject persistent scripts via the CSS editor POST parameter.
- Security
CVE-2026-15142: Real Estate Manager Pro Privilege Escalation via Capability Confusion
CVSS 7.5 flaw in Real Estate Manager Pro for WordPress lets attackers escalate privileges by exploiting an attachment ID and user ID confusion bug.
- Security
CVE-2026-16142: TrueBooker WordPress Plugin Unauthenticated Account Takeover
A CVSS 9.8 flaw in TrueBooker for WordPress allows unauthenticated attackers to take over any user account via a vulnerable AJAX handler.
- Security
CVE-2026-18438: Templately WordPress Plugin RCE via File Upload
CVSS 8.8 flaw in Templately for WordPress lets authenticated subscribers execute arbitrary code via a filename validation bypass in file upload.
- Security
CVE-2026-14182: WooCommerce Email Verification Bypass Allows Account Takeover
A CVSS 9.8 type juggling flaw in Customer Email Verification for WooCommerce lets unauthenticated attackers take over any customer account.
- Security
CVE-2026-19425: Critical SQL Injection in Travel Agency Management System
A critical unauthenticated SQL injection vulnerability in Win Men International's Travel Agency Management System allows remote attackers to read, modify,...
- News
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
PortSwigger researcher Gareth Heyes demonstrated at Black Hat USA 2026 that CSS and HTML within emails can escape message boundaries to capture typed...
- Security
CVE-2026-19264: Critical Path Traversal in Postiz Exposes JWT Secrets and DB Credentials
A critical unauthenticated path traversal vulnerability in Postiz, the open-source social media scheduling platform, allows attackers to read arbitrary...
- Security
CVE-2026-12713: Critical SQL Injection in WPCargo Track & Trace Plugin
An unauthenticated SQL injection vulnerability (CVSS 9.1) in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows attackers to read and...
- News
Ruby on Rails Patches Critical Vulnerability Enabling File Read and RCE
The Ruby on Rails team has released an emergency patch for a critical security flaw that allows unauthenticated attackers to read arbitrary files and...
- Security
CVE-2025-65336: Critical SQL Injection in Fruits Bazar PHP Ecommerce
CVSS 9.8 SQL injection vulnerability in the show_price_by_pdtId.php endpoint of the Fruits Bazar PHP/MySQLi ecommerce project allows unauthenticated...
- Security
CVE-2025-69941: Critical SQL Injection in Tailor Management System — Measurement Endpoint
CVSS 9.8 SQL injection in SourceCodester Tailor Management System 1.0 allows unauthenticated attackers to read, modify, or delete all database records...
- Security
CVE-2025-69947: Critical SQL Injection in Tailor Management System — Customer Edit Endpoint
CVSS 9.8 SQL injection in SourceCodester Tailor Management System 1.0 exposes full customer records through an unsanitized id parameter in...
- Security
CVE-2026-15397: Missing Authorization in Subscriptions for WooCommerce Plugin
A missing authorization vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users with minimal privileges to perform...
- Security
CVE-2026-14545: TrueBooker WordPress Plugin Lets Anyone Take Over Admin Accounts
An unauthenticated password reset flaw in TrueBooker (before v1.2.4) lets any attacker set an arbitrary password on any WordPress account — including...
- Security
CVE-2026-59527: Critical SQL Injection in MapSVG WordPress Plugin
A CVSS 9.3-rated unauthenticated SQL injection vulnerability in the MapSVG WordPress plugin (versions up to 8.14.0) allows remote attackers to read and...
- News
'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
Attackers are actively chaining CVE-2026-60137 and CVE-2026-63030 just three days after disclosure, targeting one of the largest attack surfaces on the...
- Security
CVE-2026-12394: MemberGlut Plugin Lets Anyone Register as WordPress Admin
A critical privilege escalation flaw in the MemberGlut WordPress plugin allows unauthenticated users to register with any role — including administrator —...
- Security
CVE-2026-13597: WeChat QR Login WordPress Plugin Authentication Bypass
A critical authentication bypass in the WeChat QR login WordPress plugin allows unauthenticated attackers to forge login events for any account — the...
- Security
CVE-2026-14289: FacturaONE WooCommerce Plugin Allows Unauthenticated File Write
A critical unauthenticated arbitrary file write vulnerability in the FacturaONE para WooCommerce con VeriFactu plugin (before v5.37) allows attackers to...
- Security
CVE-2026-15962: PHP Object Injection in Fluent Forms Pro (CVSS 8.8)
A high-severity PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress allows authenticated attackers with...
- Security
CVE-2026-12877: Critical SQL Injection in WordPress Project Management Plugin
An unauthenticated SQL injection flaw with a CVSS score of 9.1 affects the Project Management, Bug and Issue Tracking Plugin for WordPress before version...
- Security
CVE-2026-62415: Joomla Membership Pro Allows Unauthenticated File Upload
The Joomla extension Membership Pro prior to version 4.6.2 allowed unauthenticated users to upload media assets by default, exposing sites to potential...
- Security
CVE-2026-65048: Ninja Forms Unauthenticated Stored XSS via Repeatable Fieldset
A CVSS 9.3 critical stored XSS vulnerability in the Ninja Forms WordPress plugin affects versions 3.10.4 through 3.14.9. The flaw requires no...
- Security
CVE-2026-65049: Ninja Forms Multisite Flaw Enables Network-Wide Data Deletion
A CVSS 9.3 critical incorrect authorization vulnerability in Ninja Forms 3.14.8 and prior for WordPress Multisite allows a subsite administrator to...
- News
WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Attackers are exploiting two chained critical WordPress vulnerabilities that enable unauthenticated remote code execution. A public exploit has triggered...
- Security
CVE-2026-13439: WordPress Easy Form Builder Unauthenticated Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation vulnerability in the Easy Form Builder by WhiteStudio WordPress plugin allows attackers to reset admin...
- Security
CVE-2026-10081: Unlimited Elements for Elementor Stored XSS via Google Reviews
A stored cross-site scripting vulnerability in the Unlimited Elements for Elementor WordPress plugin (before 2.0.11) allows unauthenticated attackers to...
- Security
CVE-2026-13147: Kirki WordPress Plugin SSRF Allows Unauthenticated Internal Network Scanning
A server-side request forgery vulnerability in the Kirki Customizer Framework WordPress plugin before 6.0.12 allows unauthenticated attackers to make the...
- HOWTO
Nginx + ModSecurity WAF: Protecting Web Apps with OWASP CRS
Deploy ModSecurity v3 as an Nginx module, wire in the OWASP Core Rule Set, tune false positives, and verify SQL injection and XSS are blocked — all on a...
- Security
CVE-2026-16152: SQL Injection in SourceCodester Class and Exam Timetabling System
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester Class and Exam Timetabling System 1.0. The flaw in /edit_rooma.php...
- Security
CVE-2026-16154: SQL Injection in SourceCodester Timetabling Room Management
A second SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 has been disclosed, this time affecting the /edit_room1.php...
- News
CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions
CISA has added two Joomla extension vulnerabilities to its KEV catalog after attackers began exploiting arbitrary file upload flaws in iCagenda and...
- News
iCagenda and Balbooa Forms Joomla Flaws Exploited as Zero-Days
CISA has added two maximum-severity flaws in iCagenda and Balbooa Forms Joomla extensions to its KEV catalog following confirmed zero-day exploitation in...
- Security
CVE-2026-15489: SQL Injection in TOKO-ONLINE-ROTI Login Endpoint
A high-severity SQL injection vulnerability in the TOKO-ONLINE-ROTI bakery management system allows remote attackers to manipulate the login.php Username...
- Security
CVE-2026-15490: SQL Injection in TOKO-ONLINE-ROTI Product Add Endpoint
A high-severity SQL injection vulnerability in the TOKO-ONLINE-ROTI PHP bakery system allows remote attackers to manipulate the kode_produk and kd_cs...
- News
Australia Warns of Global Campaign Targeting Vulnerable CMS Platforms
The Australian Cyber Security Centre has issued an alert about a coordinated global campaign actively exploiting unpatched vulnerabilities in WordPress,...
- Security
CVE-2026-48908: JoomShaper SP Page Builder Unrestricted File Upload RCE
A critical unrestricted file upload vulnerability in JoomShaper's SP Page Builder allows unauthenticated attackers to upload arbitrary PHP files and...
- Security
CVE-2026-14732: SQL Injection in SourceCodester Timetabling System via /edit_exam.php
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database via...
- Security
CVE-2026-14733: SQL Injection in SourceCodester Timetabling System via /edit_coursea.php
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database via...
- Security
CVE-2026-14734: SQL Injection in SourceCodester Timetabling System via /edit_product.php
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database via...
- Security
CVE-2026-14652: SQL Injection in SourceCodester Shopping Cart Admin Login
A high-severity SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 allows remote attackers to manipulate the admin...
- Security
CVE-2026-14653: SQL Injection in Shopping Cart Men's Product Delete Endpoint
A high-severity SQL injection flaw in SourceCodester Simple and Nice Shopping Cart Script 1.0 exposes the men's product delete query to remote...
- Security
CVE-2026-14654: SQL Injection in Shopping Cart Girls Product Delete Endpoint
A high-severity SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 allows remote attackers to exploit the girls...
- Security
CVE-2026-14688: SQL Injection in itsourcecode Hotel Management Admin Login
A high-severity SQL injection vulnerability in itsourcecode Online Hotel Management System 1.0 allows remote attackers to exploit the admin login page via...
- Security
SQL Injection in Multi-Vendor Online Grocery Management System (CVE-2026-14695)
A high-severity SQL injection vulnerability in SourceCodester's Multi-Vendor Online Grocery Management System 1.0 allows remote attackers to manipulate...
- Security
SQL Injection in Pizzafy E-Commerce System Exposes Order Data (CVE-2026-14713)
A remotely exploitable SQL injection flaw in SourceCodester Pizzafy E-Commerce System 1.0 allows attackers to manipulate the confirm_order endpoint via an...
- Security
Privilege Escalation via Role Manipulation in Online Exam LMS (CVE-2026-14719)
A high-severity improper privilege management flaw in SourceCodester's Online Examination and Learning Management System 1.0 allows remote attackers to...
- Security
CVE-2026-14622: Missing Authentication in Restaurant Website PHP/MySQL AJAX Endpoint
A missing authentication vulnerability (CVSS 7.3) in the jairiidriss/restaurant-website-php-mysql project exposes the /admin/ajax_files endpoint to...
- Security
CVE-2026-13487: SQL Injection in SourceCodester Timetabling System (/archive.php)
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated attackers to manipulate the...
- Security
CVE-2026-13488: SQL Injection in SourceCodester Timetabling System (/preview7.php)
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated attackers to manipulate the...
- Security
CVE-2026-13498: SQL Injection in Restaurant Management System via Password Reset
A high-severity SQL injection vulnerability in yashpokharna2555's restaurant management system allows unauthenticated attackers to exploit the...
- News
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Active exploitation of CVE-2026-4020 in the Gravity SMTP WordPress plugin has generated over 17 million malicious requests, allowing unauthenticated...
- Security
CVE-2009-10007: Catalyst::Plugin::Authentication Session Fixation
CVSS 9.1 session fixation flaw in Perl's Catalyst auth plugin (before 0.10_027) lets attackers impersonate authenticated users by pre-planting a known...
- News
Critical Everest Forms Pro Flaw Exploited to Take Over WordPress Sites
Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin, enabling them to take complete control of…
- News
Suspicious Polyfill Login Prompts Pop Up on Toshiba, Muji Websites
Tech giant Toshiba and mega-retailer Muji have warned visitors that suspicious sign-in screens appearing on their websites could be harvesting credentials — a…
- Security
CVE-2026-49191: M3WebServer Hard-Coded API Keys Exposed via Error Pages
A critical CVSS 9.8 vulnerability in M3WebServer hard-codes backend API keys in the production build. Attackers intercept them through verbose error handling…
- News
Critical Kirki Flaw Exploited to Hijack WordPress Admin Accounts
Hackers are actively exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the widely-used Kirki Customizer Framework plugin for…
- News
WP Maps Pro Bug Exploited to Create Admin Accounts on WordPress Sites
Hackers are actively exploiting a critical vulnerability in the WP Maps Pro WordPress plugin that allows unauthenticated attackers to create rogue…
- Security
CVE-2018-25405: Multiple SQL Injections in eNdonesia Portal 8.7
Multiple unauthenticated SQL injection vulnerabilities in eNdonesia Portal 8.7 allow attackers to extract sensitive database contents via the artid, cid,...
- Security
CVE-2018-25406: SQL Injection Across eNdonesia Portal 8.7 Modules
Multiple unauthenticated SQL injection vulnerabilities in eNdonesia Portal 8.7 expose the publisher, artikel, and info modules to database extraction...
- Security
CVE-2018-25411: SQL Injection in MGB OpenSource Guestbook 0.7.0.2
An unauthenticated SQL injection vulnerability in MGB OpenSource Guestbook 0.7.0.2 allows attackers to extract sensitive database contents via the 'id'...
- Security
CVE-2018-25412: Arbitrary File Upload RCE in Delta Sql 1.8.2
A critical unauthenticated arbitrary file upload vulnerability in Delta Sql 1.8.2 allows attackers to upload malicious PHP files and achieve remote code...
- Security
CVE-2026-10178: SQL Injection in Online Music Site 1.0 Admin Panel
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Online Music Site 1.0, affecting the Administrator PHP AdminEditAlbum…
- Security
CVE-2026-7465: RCE in Spectra Gutenberg Blocks WordPress Plugin (CVSS 8.8)
A high-severity remote code execution vulnerability in the Spectra Gutenberg Blocks plugin for WordPress allows authenticated Contributor-level attackers...
- Security
CVE-2025-15609: Fortis for WooCommerce Plugin Leaks API
The Fortis for WooCommerce WordPress plugin before version 1.3.1 exposes sensitive API keys to unauthenticated attackers, enabling unauthorized access to...
- Security
CVE-2026-8785: SQL Injection in Hospital Management System
A high-severity SQL injection vulnerability (CVE-2026-8785, CVSS 7.3) has been disclosed in projectworlds Hospital Management System in PHP 1.0, allowing...
- News
Avada Builder WordPress Plugin Flaws Allow Site Credential
Two vulnerabilities in the Avada Builder plugin for WordPress, with an estimated one million active installations, allow hackers to read arbitrary files...
- Security
CVE-2025-61311: Reflected XSS in docuForm Managed Print
A reflected cross-site scripting vulnerability in the dfm-menu_alerts.php component of GmbH Mecury docuForm v11.11c allows attackers to execute arbitrary...
- Security
CVE-2026-5324: WordPress Brizy Page Builder Unauthenticated
The Brizy Page Builder plugin for WordPress contains a critical unauthenticated Stored Cross-Site Scripting flaw in versions up to 2.8.11, enabling...
- Security
CVE-2026-7224: SQL Injection in Pizzafy Ecommerce System 1.0
A high-severity SQL injection vulnerability has been discovered in SourceCodester Pizzafy Ecommerce System 1.0, allowing remote attackers to manipulate...
- Security
CVE-2026-7077: SQL Injection in itsourcecode Courier
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Courier Management System 1.0, affecting the edit_parcel.php file...
- News
Hackers Actively Exploiting Breeze Cache File Upload Bug in WordPress Attacks
Threat actors are mass-exploiting a critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin, uploading PHP webshells to...
- Security
CVE-2026-3844 — Breeze Cache WordPress Plugin
A critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin allows attackers to upload arbitrary files to affected servers...
- Security
CVE-2026-6595: SQL Injection in ProjectsAndPrograms School
A medium-severity SQL injection vulnerability has been disclosed in ProjectsAndPrograms School Management System, allowing remote attackers to manipulate...
- Security
CVE-2026-6004: SQL Injection in code-projects Simple IT
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Simple IT Discussion Forum 1.0, affecting the /delete-category.php...
- Security
CVE-2026-5554: SQL Injection in Concert Ticket Reservation
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Concert Ticket Reservation System 1.0, affecting the...
- Security
CVE-2026-5555: SQL Injection in Concert Ticket Reservation
An unauthenticated SQL injection vulnerability has been disclosed in code-projects Concert Ticket Reservation System 1.0, affecting the login.php file via...
- Security
CVE-2026-5575: SQL Injection in SourceCodester Record
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester/jkev Record Management System 1.0, affecting the Login page's...
- Security
CVE-2026-5551: SQL Injection in itsourcecode Free Hotel
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Free Hotel Reservation System 1.0, affecting the login page's email...
- Security
CVE-2026-5017: SQL Injection in code-projects Simple Food
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Simple Food Order System 1.0, affecting the /all-tickets.php file...
- Security
CVE-2026-5018: SQL Injection in code-projects Simple Food
A remotely exploitable SQL injection vulnerability exists in code-projects Simple Food Order System 1.0, where the Name parameter in register-router.php...
- Security
CVE-2026-5019: SQL Injection in code-projects Simple Food
A SQL injection vulnerability has been disclosed in code-projects Simple Food Order System 1.0, where the Status parameter in all-orders.php enables...
- Security
CVE-2026-5033: SQL Injection in code-projects Accounting
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Accounting System 1.0, where the cos_id parameter in...
- Security
CVE-2026-5034: SQL Injection in code-projects Accounting
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Accounting System 1.0, allowing unauthenticated attackers to...
- Security
CVE-2015-20118: Stored XSS in RealtyScript 4.0.2 Admin
A stored cross-site scripting vulnerability in RealtyScript 4.0.2 allows attackers to inject malicious JavaScript via the location_name parameter in the...
- News
AppsFlyer Web SDK Supply Chain Attack Spread
Attackers hijacked AppsFlyer's CDN domain via a registrar incident, serving a sophisticated 170 KB crypto-stealing JavaScript payload to every site...
- Security
CVE-2026-3730: SQL Injection in itsourcecode Free Hotel
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Free Hotel Reservation System 1.0, affecting the amenities admin...
- Security
CVE-2026-3734: Improper Authorization in SourceCodester
A remotely exploitable improper authorization vulnerability has been disclosed in SourceCodester Client Database Management System 1.0, allowing...
- Security
CVE-2026-3740: SQL Injection in itsourcecode University
A high-severity SQL injection vulnerability has been disclosed in itsourcecode University Management System 1.0, allowing remote attackers to execute...
- Security
CVE-2018-25165: SQL Injection Disclosed in Galaxy Forces MMORPG
A SQL injection vulnerability in Galaxy Forces MMORPG version 0.5.8 has been formally catalogued by NVD, enabling authenticated attackers to extract...
- Security
Critical RCE in WPvivid Backup Plugin Threatens 900,000+
A critical unauthenticated arbitrary file upload vulnerability in the WPvivid Backup & Migration plugin allows remote code execution on over 900,000...
- Security
NGINX TLS Vulnerability Enables Man-in-the-Middle Attacks
CVE-2026-1642 affects NGINX OSS and Plus when proxying to upstream TLS servers, allowing attackers to inject plaintext data into responses.
- Security
WordPress Plugin Vulnerability (CVSS 10.0) Under Active
Maximum severity flaw in Modular DS WordPress plugin allows unauthenticated privilege escalation. All versions through 2.5.1 affected with active...