The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.
The Save as PDF Plugin by PDFCrowd for WordPress (versions up to 4.6.1) contains a code injection vulnerability via the pdf_created_callback shortcode attribute. This flaw allows authenticated users with Contributor-level access or higher to invoke arbitrary PHP functions or static class methods without proper validation. The vulnerability arises because user-supplied shortcode attributes are copied without sanitization into an options array, encrypted, and later decrypted and executed without capability checks. This can lead to disclosure of sensitive data such as the site's PDFCrowd API key and username, or further server-side compromise.
The WP Recipe Maker WordPress plugin up to version 10.8.1 contains a critical vulnerability allowing unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side. This occurs because the plugin executes shortcodes embedded in user-supplied comment content without proper sanitization before rendering recipe pages. Exploitation requires the attacker's comment to be approved, after which malicious shortcode output can be embedded in the page metadata and disclosed to visitors.
Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to and including 1.57.2 contains a critical vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs due to improper validation before invoking the do_shortcode function, leading to potential code injection.
IBM Guardium Data Protection version 12.2 contains a critical vulnerability involving improper control of code generation (CWE-94) in the Change Audit System (CAS) listener. This flaw allows unauthenticated network attackers who can access TCP port 16017 to submit crafted serialized messages that may lead to unintended code execution on the Guardium appliance. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.
CVE-2026-54612 is a path traversal vulnerability in givanz Vvveb CMS versions from 1.0.0 up to but not including 1.0.8.5. An authenticated user with Editor role permissions can exploit this flaw to write arbitrary PHP files outside the intended theme directory. This can lead to persistent webshell placement and full compromise of the application’s confidentiality, integrity, and availability. The vulnerability is fixed in version 1.0.8.5.
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives. A crafted plugin archive can chain relative symbolic link
entries to escape the plugin installation directory, writing arbitrary files and an
executable backend binary outside that directory. The dropped executable runs with the
privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin
signature does not prevent the write. An operator can therefore be affected by
installing a plugin that appears legitimate, as well as by installing a plugin from an
arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or
preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as
Grafana OSS.
CVE-2026-77281 is a medium severity vulnerability in caddyserver caddy versions prior to 2.11.4. It involves improper control of code generation (code injection) in the rewrite handler and placeholder layer. Specifically, when a rewrite URI ends with a literal question mark, attacker-controlled replacement bytes can be passed through a second placeholder expansion, potentially disclosing environment or request-variable data and readable files if the file provider module is registered. This issue is fixed in version 2.11.4.
Chamilo LMS versions prior to 2.0.1 contain a critical path traversal vulnerability (CWE-22) that allows unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability is fixed in version 2.0.1. The advisory does not specify the affected endpoint or exploitation details. The CVSS score is 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript. In plugins/chrome/tabs.go, tabsTable.Insert() passes the URL through fmt.Sprintf(newTabScript, url), and tabsTable.Update() uses fmt.Sprintf(setURLScript, pk, url). A URL containing quote and newline characters can break out of the intended string or property record and append script statements, resulting in arbitrary command execution with the privileges of the anyquery process on the macOS host. This issue is fixed in version 0.4.5.
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.
CVE-2026-89083 is a critical vulnerability in HP Inc's HP AC Print & Scan software, specifically in the HP Advance component. It involves a CWE-94 issue that may allow elevation of privilege, remote code execution, or arbitrary file write on the HP Advance server under certain conditions. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact if exploited. No affected versions or patch information are provided.
CVE-2026-89082 is a critical vulnerability in HP Inc's HP AC Print & Scan software, specifically in the HP Advance software component. The flaw is categorized as CWE-94, indicating improper control of code generation, which can lead to elevation of privilege, remote code execution, or arbitrary file write on the HP Advance server. This vulnerability allows an unauthenticated attacker to execute code remotely with high impact on confidentiality, integrity, and availability. No specific affected versions or patches are provided in the available data.
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor, prototype, or __proto__ properties in packages/respect-core/src/modules/context-parser/get-value-from-context.ts, reach the JavaScript Function constructor, and execute arbitrary code when a user processes an untrusted description. The executed code runs with the privileges of the CLI process and can execute shell commands or read CI secrets. Users processing only trusted, self-authored workflows are not affected. This issue is fixed in @redocly/respect-core and @redocly/cli version 2.33.0.
CVE-2026-73456 is a critical vulnerability in Arista Networks EOS affecting versions 4.34.2F through 4.34.7M, 4.35.0 through 4.35.5M, and 4.36.0 through 4.36.1F. It involves improper control of code generation (CWE-94) in the gRPC Network Packet Sampling Interface (gNPSI). An unauthenticated attacker can exploit this flaw to execute arbitrary code, gaining full administrative control over the affected switch.
CVE-2026-90999 is a critical vulnerability in Functional Software, Inc.'s Sentry Seer that involves improper input validation. This flaw allows an unauthenticated attacker to submit malicious telemetry data that is subsequently executed as code by a privileged automation agent. The attacker does not need access to the victim's Sentry account, source repository, or infrastructure to exploit this issue.