Current: English
Writing on engineering, product, and everything in between.
The Perfex CRM research repository documents a multi-stage unauthenticated compromise chain affecting versions through 3.4.x. The chain combines an unauthenticated SQL injection in the migration controller with sensitive-token extraction and an unsafe sales-attachment upload path.
The Responsive FileManager research repository documents an authenticated remote code execution issue affecting versions through 9.14.0. The vulnerable save_img functionality can combine insufficient filename validation with path traversal to write attacker-controlled content into a web-accessible l...
CVE-2025-6254 affects the Doctreat Core WordPress plugin through version 1.6.8. The vulnerability allows unauthenticated attackers to register an account with administrator privileges because the registration handler does not properly restrict the requested role.
CVE-2026-5118 affects Divi Form Builder through version 5.1.2. The vulnerability allows unauthenticated attackers to create administrator accounts by manipulating the role value accepted during public form registration.
CVE-2026-8181 affects Burst Statistics – Privacy-Friendly WordPress Analytics versions 3.4.0 through 3.4.1.1. The vulnerability is an authentication bypass that can allow an unauthenticated attacker who knows an administrator username to impersonate that administrator during a request.
CVE-2026-3584 affects the Kali Forms WordPress plugin through version 2.4.9. The vulnerability allows unauthenticated remote code execution through the form_process functionality because attacker-controlled values can reach dynamic PHP callback execution.
Authenticated Arbitrary File Upload via Support Ticket Attachment
The ApexForum research repository documents an authenticated arbitrary file upload vulnerability in a Laravel-based forum application. The upload endpoint does not adequately validate file type and can store dangerous content in a publicly accessible directory.
CVE-2025-52078 affects the Writebot – AI Content Generator SaaS React Template through version 4.0.0. The vulnerability is an unauthenticated file-upload issue associated with the /file-upload endpoint.