Current: English
Posts tagged PHP.
CVE-2025-4601 affects the RH - Real Estate WordPress Theme through version 4.4.0. An authenticated user with subscriber-level access or higher can potentially manipulate their account role and escalate to administrator privileges.
The WorkDo research repository documents an authenticated privilege-escalation issue affecting multiple Laravel-based WorkDo products. The issue is associated with account creation and role assignment, where a user-controlled role identifier can potentially be manipulated to obtain a higher-privileg...
The SmartEnd research repository documents an authenticated privilege-escalation issue in the SmartEnd Laravel CMS. A low-privilege authenticated user can potentially manipulate the permissions_id value used by the user-role update functionality and obtain elevated privileges.
The public Streamit research repository documents an authenticated arbitrary file upload vulnerability in the Streamit WordPress theme. A logged-in subscriber-level user can abuse the profile-avatar upload functionality when file-type validation is insufficient, creating a potential path to remote c...
CVE-2025-47577 affects the TI WooCommerce Wishlist WordPress plugin through version 2.9.2. The issue is an unrestricted file upload vulnerability that can allow an unauthenticated attacker to place dangerous files on a vulnerable WordPress installation, with potential for remote code execution depen...
Unauthenticated Arbitrary File Upload in Crawlomatic Multipage Scraper Post Generator
Unauthenticated Arbitrary File Upload in Drag and Drop Multiple File Upload for WooCommerce
CVE-2025-3419 affects the Event Manager, Events Calendar, Tickets, Registrations – Eventin WordPress plugin through version 4.0.26. The vulnerability allows unauthenticated attackers to read arbitrary files from the server through the plugin's image-proxy functionality, potentially exposing sensitiv...
Unauthenticated Arbitrary Options Update in Order Delivery Date for WooCommerce