Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-12325 | 5.5 medium | 1.0% | mayurik, best_salon_management_system | A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | 8 Oct |
| CVE-2025-12378 | 5.5 medium | 1.0% | fabian, simple_food_ordering_system | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. Performing manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. | 8 Oct |
| CVE-2025-13565 | 5.5 medium | 1.0% | warren-daloyan, inventory_management_system | A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from remote. The exploit has been made available to the public and could be exploited. | 8 Oct |
| CVE-2024-33724 | 5.4 medium | 1.0% | no CPE yet | SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. | Wed 28 Oct |
| CVE-2026-103528 | 5.4 medium | 1.0% | no CPE yet | Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server. | 15 Oct |
| CVE-2026-42878 | 5.3 medium | 1.0% | no CPE yet | FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026. | Mon 26 Oct |
| CVE-2026-46629 | 5.3 medium | 1.0% | symfony, twig | Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig\Environment. This issue is fixed in version 3.26.0. | 24 Oct |
| CVE-2026-61457 | 5.3 medium | 1.0% | no CPE yet | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution. | 24 Oct |
| CVE-2026-57311 | 5.3 medium | 1.0% | no CPE yet | Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions. | 24 Oct |
| CVE-2026-11772 | 5.1 medium | 1.0% | no CPE yet | DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is in End Of Life phase and will not receive any updates. However, deleting info.php file mitigates the vulnerability, | 25 Oct |
| CVE-2026-63302 | 5.1 medium | 1.0% | no CPE yet | Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure). The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary. | 24 Oct |
| CVE-2026-46594 | 5.1 medium | 1.0% | no CPE yet | A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1. | 23 Oct |
| CVE-2025-13879 | 5.1 medium | 1.0% | efficientip, solidserver_ip_address_management | Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. This vulnerability allows an authenticated user with administrator privileges to list directories other than those to which the have authorized access using the 'directory' parameter in '/mod/ajax.php?action=sections/list/list'.For examplem setting the 'directory' parameter to '/' displays files outside the 'LOCAL:///' folder. | 18 Oct |
| CVE-2026-104739 | 4.9 medium | 1.0% | rabilal, js help desk – ai-powered support & ticketing system | The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a two-step sequence: an administrator first saves a traversal-crafted value in the support_custom_img configuration field, then triggers deletion by uploading a new support custom image, at which point setSupportCustomImage() resolves and deletes the attacker-controlled path. | Fri 30 Oct |
| CVE-2025-13677 | 4.9 medium | 1.0% | no CPE yet | The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path validation in the `simple_download_counter_parse_path()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which may contain sensitive information such as database credentials (wp-config.php) or system files. Please note that the vendor opted to continue to allow remote file downloads from arbitrary locations on the server, however, has disabled this functionality on multi-sites and provided a warning to site owners in the readme.txt when they install the plugin. While not an optimal patch, we have considered this sufficient and recommend users proceed to use the plugin with caution. | 14 Oct |
| CVE-2026-104722 | 4.9 medium | 1.0% | no CPE yet | The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). | 13 Oct |
| CVE-2025-13698 | 4.5 medium | 1.0% | no CPE yet | Deciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Deciso OPNsense. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of backup configuration files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root. Was ZDI-CAN-28133. | 19 Oct |
| CVE-2023-0785 | 3.7 low | 1.0% | mayurik, best_online_news_portal | A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file check_availability.php. The manipulation of the argument username leads to exposure of sensitive information through data queries. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-220645 was assigned to this vulnerability. | Wed 28 Oct |
| CVE-2025-11938 | 2.9 low | 1.0% | churchcrm | A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DB_PASSWORD/ROOT_PATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | 19 Oct |
| CVE-2026-111233 | 2.3 low | 1.0% | pfsense | Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges. | 19 Oct |
| CVE-2026-13549 | 2.1 low | 1.0% | no CPE yet | A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/controllers/Report.php of the component Report Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. | 25 Oct |
| CVE-2026-18644 | 2.1 low | 1.0% | no CPE yet | A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | 23 Oct |
| CVE-2026-18645 | 2.1 low | 1.0% | no CPE yet | A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | 23 Oct |
| CVE-2026-18959 | 2.1 low | 1.0% | no CPE yet | A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | 23 Oct |
| CVE-2026-112299 | 2.1 low | 1.0% | no CPE yet | A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | 20 Oct |
| CVE-2025-9663 | 2.1 low | 1.0% | fabian, simple_grading_system | A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /edit_account.php of the component Admin Panel. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. | 18 Oct |
| CVE-2025-9664 | 2.1 low | 1.0% | fabian, simple_grading_system | A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the component Admin Panel. The manipulation of the argument Add results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. | 18 Oct |
| CVE-2025-13345 | 2.1 low | 1.0% | oretnom23, train_station_ticketing_system | A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_ticket. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. | 18 Oct |
| CVE-2025-11941 | 2.1 low | 1.0% | e107 | A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | 8 Oct |
| CVE-2025-11939 | 2.0 low | 1.0% | churchcrm | A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/RestoreJob.php of the component Backup Restore Handler. Executing a manipulation of the argument restoreFile can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | 19 Oct |
| CVE-2025-15187 | 2.0 low | 1.0% | njtech, greencms | A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a manipulation of the argument sqlFiles/zipFiles results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer. | 13 Oct |
| CVE-2026-78435 | 2.0 low | 1.0% | no CPE yet | A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | 12 Oct |
| CVE-2025-11944 | 2.0 low | 1.0% | vvveb | A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52204b4a106b2fb02d16eee06a88a1f2697f9b35. It is recommended to apply a patch to fix this issue. | 8 Oct |
| CVE-2025-12201 | 2.0 low | 1.0% | ajayrandhawa, user-management-php-mysql | A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. | 8 Oct |
| CVE-2026-12260 | 10.0 critical | 0.00% | no CPE yet | SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment. | 8 Oct |
| CVE-2026-34037 | 9.9 critical | 0.00% | no CPE yet | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464. | 25 Oct |
| CVE-2025-66255 | 9.9 critical | 0.00% | dbbroadcast, mozart_next_3000_firmware, mozart_next_3500_firmware, mozart_next_50_firmware | Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages. The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution | 18 Oct |
| CVE-2025-66256 | 9.9 critical | 0.00% | dbbroadcast, mozart_next_100_firmware, mozart_next_1000_firmware, mozart_next_2000_firmware | Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files. | 18 Oct |
| CVE-2026-90888 | 9.8 critical | 0.00% | leadsnap | Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | Fri 30 Oct |
| CVE-2026-54856 | 9.8 critical | 0.00% | themerex, rexcoin | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | Fri 30 Oct |
| CVE-2026-54857 | 9.8 critical | 0.00% | themerex, quirky | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | Fri 30 Oct |
| CVE-2026-54860 | 9.8 critical | 0.00% | themerex, ozisti | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | Fri 30 Oct |
| CVE-2026-61992 | 9.8 critical | 0.00% | von eyal fitoussi, geo my wordpress | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | Fri 30 Oct |
| CVE-2026-61998 | 9.8 critical | 0.00% | themerex, le truffe | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | Fri 30 Oct |
| CVE-2026-62003 | 9.8 critical | 0.00% | themerex, mission | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | Fri 30 Oct |
| CVE-2026-62004 | 9.8 critical | 0.00% | themerex, motorix | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | Fri 30 Oct |
| CVE-2026-62005 | 9.8 critical | 0.00% | themerex, muzicon | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | Fri 30 Oct |
| CVE-2026-62009 | 9.8 critical | 0.00% | themerex, filmax | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | Fri 30 Oct |
| CVE-2026-62010 | 9.8 critical | 0.00% | themerex, avventure | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | Fri 30 Oct |
| CVE-2026-62011 | 9.8 critical | 0.00% | themerex, bonbon | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | Fri 30 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.