Total
7610 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-12866 | 2026-07-07 | N/A | 9.8 CRITICAL | ||
| All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context. | |||||
| CVE-2026-43921 | 2026-07-07 | N/A | N/A | ||
| FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration. | |||||
| CVE-2026-11778 | 2026-07-06 | N/A | 5.4 MEDIUM | ||
| The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | |||||
| CVE-2026-56264 | 1 Kidocode | 1 Crawl4ai | 2026-07-06 | N/A | 8.1 HIGH |
| Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server's browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser's relaxed security settings, perform server-side request forgery against internal services. | |||||
| CVE-2026-30460 | 1 Thedaylightstudio | 1 Fuel Cms | 2026-07-05 | N/A | 8.8 HIGH |
| Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module. | |||||
| CVE-2026-30457 | 1 Thedaylightstudio | 2 Dwoo, Fuel Cms | 2026-07-05 | N/A | 9.8 CRITICAL |
| An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code. | |||||
| CVE-2025-50881 | 2026-07-05 | N/A | 8.8 HIGH | ||
| The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the `action` URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the `eval()` function. Although a `method_exists()` check is performed, it only validates the part of the user input *before* the first parenthesis `(`, allowing an attacker to append arbitrary PHP code after a valid method call structure. Successful exploitation allows an unauthenticated or trivially authenticated attacker to execute arbitrary PHP code on the server with the privileges of the web server process. | |||||
| CVE-2025-50567 | 2026-07-05 | N/A | 10.0 CRITICAL | ||
| Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code execution. | |||||
| CVE-2024-50660 | 1 Ipublishmedia | 1 Adportal | 2026-07-05 | N/A | 9.8 CRITICAL |
| File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality | |||||
| CVE-2024-50658 | 1 Ipublishmedia | 1 Adportal | 2026-07-05 | N/A | 9.8 CRITICAL |
| Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in updateuserinfo.html file | |||||
| CVE-2025-70364 | 2026-07-05 | N/A | 8.8 HIGH | ||
| An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server. NOTE: the Supplier's position is that this is "a historical and intended administrative feature of the product, accessible only to already authenticated users explicitly granted administrator privileges." However, restrictions on some PHP functions were added in 8.4. | |||||
| CVE-2026-31018 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-07-05 | N/A | 8.8 HIGH |
| In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation. | |||||
| CVE-2025-66848 | 1 Jdcloud | 12 Ax1800, Ax1800 Firmware, Ax3000 and 9 more | 2026-07-05 | N/A | 9.8 CRITICAL |
| JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability. | |||||
| CVE-2025-61260 | 2026-07-05 | N/A | 9.8 CRITICAL | ||
| A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately. | |||||
| CVE-2025-57567 | 2026-07-05 | N/A | 9.1 CRITICAL | ||
| A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands. | |||||
| CVE-2025-56588 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-07-05 | N/A | 8.8 HIGH |
| Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter. | |||||
| CVE-2025-56399 | 2026-07-05 | N/A | 8.8 HIGH | ||
| alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload. A file with a '.png` extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side validation, the file is still saved on the server. The attacker can then use the rename API to change the file extension to `.php`, and upon accessing it via a public URL, the server executes the embedded code. | |||||
| CVE-2025-53867 | 2026-07-05 | N/A | 9.8 CRITICAL | ||
| Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL. | |||||
| CVE-2025-45947 | 1 Phpgurukul | 1 Online Banquet Booking System | 2026-07-05 | N/A | 9.8 CRITICAL |
| An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account - Change Password component | |||||
| CVE-2025-25789 | 1 Foxcms | 1 Foxcms | 2026-07-05 | N/A | 9.8 CRITICAL |
| FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php. | |||||