Current: English
Posts tagged PHP.
CVE-2026-8181 affects Burst Statistics – Privacy-Friendly WordPress Analytics versions 3.4.0 through 3.4.1.1. The vulnerability is an authentication bypass that can allow an unauthenticated attacker who knows an administrator username to impersonate that administrator during a request.
CVE-2026-3584 affects the Kali Forms WordPress plugin through version 2.4.9. The vulnerability allows unauthenticated remote code execution through the form_process functionality because attacker-controlled values can reach dynamic PHP callback execution.
Authenticated Arbitrary File Upload via Support Ticket Attachment
The ApexForum research repository documents an authenticated arbitrary file upload vulnerability in a Laravel-based forum application. The upload endpoint does not adequately validate file type and can store dangerous content in a publicly accessible directory.
CVE-2025-52078 affects the Writebot – AI Content Generator SaaS React Template through version 4.0.0. The vulnerability is an unauthenticated file-upload issue associated with the /file-upload endpoint.
The MagicAI research repository documents an authenticated arbitrary file upload vulnerability in the Laravel + Vue SaaS application. The issue affects the chat file-analyzer upload feature, where insufficient validation between a declared MIME type and the actual file content can allow dangerous co...
The Davinci AI research repository documents an Insecure Direct Object Reference vulnerability in the team-management functionality of a Laravel + Vue SaaS application. An authenticated user can potentially manipulate team data belonging to other users by changing a user-controlled team identifier.
CVE-2025-5394 affects the Alone – Charity Multipurpose Non-profit WordPress Theme through version 7.8.3. The theme exposes a plugin-installation function without sufficient capability checks, allowing unauthenticated attackers to upload and install plugin packages from remote locations.
CVE-2025-4606 affects the Sala – Startup & SaaS WordPress Theme through version 1.1.4. The vulnerability allows unauthenticated attackers to change passwords for arbitrary users, including administrators, because the password-update functionality does not properly establish the identity of the reque...