Mon, Jun 08 · 02:16 AM CDTCVE-2023-54352
9.8/10 · Must read/watchNVDvuln
Summary
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional f
CVECVE-2023-54352
SeverityCRITICAL
TypeNEW
PublishedMon, Jun 08 · 02:16 AM CDT
ModifiedMon, Jun 08 · 02:16 AM CDT
CVE-2024-58348
9.8/10 · Must read/watchNVDvuln
Summary
WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.
CVECVE-2024-58348
SeverityCRITICAL
TypeNEW
PublishedMon, Jun 08 · 02:16 AM CDT
ModifiedMon, Jun 08 · 02:16 AM CDT
CVE-2024-58349
9.8/10 · Must read/watchNVDvuln
Summary
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code
CVECVE-2024-58349
SeverityCRITICAL
TypeNEW
PublishedMon, Jun 08 · 02:16 AM CDT
ModifiedMon, Jun 08 · 02:16 AM CDT
CVE-2026-11499
9.8/10 · Must read/watchNVDvuln
Summary
A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.
CVECVE-2026-11499
SeverityCRITICAL
TypeNEW
PublishedMon, Jun 08 · 09:16 AM CDT
ModifiedMon, Jun 08 · 09:16 AM CDT
CVE-2026-11498
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. Affected by this issue is the function asp_voip_OtherSet of the file /boaform/voip_other_set of the component Web Management Interface. Performing a manipulation of the argument funckey_transfer results in stack-based buffer overflow. The attack is p
CVECVE-2026-11498
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 09:16 AM CDT
ModifiedMon, Jun 08 · 09:16 AM CDT
CVE-2026-11503
8.8/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in Tenda CX12L 16.03.53.12. The affected element is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set of the component Wi-Fi Configuration Endpoint. Such manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be l
CVECVE-2026-11503
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 10:16 AM CDT
ModifiedMon, Jun 08 · 10:16 AM CDT
CVE-2026-41722
8.0/10 · Worth your timeNVDvuln
Summary
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
CVECVE-2026-41722
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 09:16 AM CDT
ModifiedMon, Jun 08 · 09:16 AM CDT
CVE-2026-41723
8.0/10 · Worth your timeNVDvuln
Summary
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
CVECVE-2026-41723
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 09:16 AM CDT
ModifiedMon, Jun 08 · 09:16 AM CDT
CVE-2026-41724
8.0/10 · Worth your timeNVDvuln
Summary
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
CVECVE-2026-41724
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 09:16 AM CDT
ModifiedMon, Jun 08 · 09:16 AM CDT
CVE-2026-33999
7.8/10 · Worth your timeNVDvuln
Summary
A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other sever
CVECVE-2026-33999
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 23 · 04:16 PM CDT
ModifiedMon, Jun 08 · 05:16 AM CDT
CVE-2026-34001
7.8/10 · Worth your timeNVDvuln
Summary
A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corr
CVECVE-2026-34001
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 23 · 04:16 PM CDT
ModifiedMon, Jun 08 · 05:16 AM CDT
CVE-2026-34003
7.8/10 · Worth your timeNVDvuln
Summary
A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of S
CVECVE-2026-34003
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 23 · 04:16 PM CDT
ModifiedMon, Jun 08 · 05:16 AM CDT
CVE-2023-54350
7.5/10 · Worth your timeNVDvuln
Summary
WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files i
CVECVE-2023-54350
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 02:16 AM CDT
ModifiedMon, Jun 08 · 02:16 AM CDT
CVE-2026-3238
7.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using spe
CVECVE-2026-3238
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 09:16 AM CDT
ModifiedMon, Jun 08 · 09:16 AM CDT
CVE-2026-49494
7.5/10 · Worth your timeNVDvuln
Summary
Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose decla
CVECVE-2026-49494
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 01:16 PM CDT
ModifiedSun, Jun 07 · 01:16 PM CDT
CVE-2026-11460
7.3/10 · Worth your timeNVDvuln
Summary
A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a dis
CVECVE-2026-11460
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 08:16 PM CDT
ModifiedSun, Jun 07 · 08:16 PM CDT
CVE-2026-11462
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper authorization. The attack can b
CVECVE-2026-11462
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 11:16 PM CDT
ModifiedSun, Jun 07 · 11:16 PM CDT
CVE-2026-11463
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was determined in USCiLab Cereal up to 1.3.2. Affected is an unknown function of the component Shared Pointer Handler. Executing a manipulation can lead to type confusion. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early abo
CVECVE-2026-11463
SeverityHIGH
TypeNEW
PublishedSun, Jun 07 · 11:16 PM CDT
ModifiedSun, Jun 07 · 11:16 PM CDT
CVE-2026-11471
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /index2.php. The manipulation of the argument Password results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVECVE-2026-11471
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 01:16 AM CDT
ModifiedMon, Jun 08 · 01:16 AM CDT
CVE-2026-11472
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /index1.php. This manipulation of the argument Password causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVECVE-2026-11472
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 01:16 AM CDT
ModifiedMon, Jun 08 · 01:16 AM CDT
CVE-2026-11474
7.3/10 · Worth your timeNVDvuln
Summary
A security flaw has been discovered in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected is an unknown function of the file service/RegisterService.php of the component Registration Endpoint. Performing a manipulation of the argument stimg results in unrestricted upload. The at
CVECVE-2026-11474
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 01:16 AM CDT
ModifiedMon, Jun 08 · 01:16 AM CDT
CVE-2026-11482
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /archive5.php. The manipulation of the argument sy leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVECVE-2026-11482
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 03:16 AM CDT
ModifiedMon, Jun 08 · 03:16 AM CDT
CVE-2026-11483
7.3/10 · Worth your timeNVDvuln
Summary
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /archive4.php. The manipulation of the argument sy results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for atta
CVECVE-2026-11483
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 05:16 AM CDT
ModifiedMon, Jun 08 · 05:16 AM CDT
CVE-2026-11484
7.3/10 · Worth your timeNVDvuln
Summary
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /archive3.php. This manipulation of the argument sy causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for att
CVECVE-2026-11484
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 05:16 AM CDT
ModifiedMon, Jun 08 · 05:16 AM CDT
CVE-2026-11485
7.3/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive2.php. Such manipulation of the argument sy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVECVE-2026-11485
SeverityHIGH
TypeNEW
PublishedMon, Jun 08 · 05:16 AM CDT
ModifiedMon, Jun 08 · 05:16 AM CDT
