Threat database

CVE-2026-78533 is a critical vulnerability in AncoraThemes Qwery versions up to and including 3.6.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.

CVE-2026-66567 is a critical vulnerability in AncoraThemes Anesta versions up to 1.5.3 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-66482 is a critical vulnerability in AncoraThemes Drone Media versions up to 2.2.0 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring any user interaction or privileges.

CVE-2026-42724 is a high-severity vulnerability in AncoraThemes CleanSkin versions up to and including 1.5.0. It involves an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP code. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-42723 is a critical vulnerability in AncoraThemes CleanSkin version 1.5.0 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified as CWE-502. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-65578 is a critical vulnerability in AncoraThemes Agora versions 1.9 and earlier. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without authentication. The CVSS 3.1 score is 9.8, indicating a high impact on confidentiality, integrity, and availability.

CVE-2026-65577 is a critical vulnerability in AncoraThemes Advice versions up to and including 1.18.0. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication.

CVE-2026-65576 is a critical vulnerability in AncoraThemes Adrena versions up to and including 1.2.14. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows remote attackers to execute arbitrary code without any authentication.

CVE-2026-65575 is a critical vulnerability in AncoraThemes Accalia versions up to and including 1.5.3. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.

CVE-2026-65574 is a critical vulnerability in AncoraThemes Abogado versions up to and including 1.18. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). The vulnerability has a high CVSS score of 9.8, indicating it allows remote attackers to execute arbitrary code without any privileges or user interaction.

Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wizor's wizors-investments allows PHP Local File Inclusion.This issue affects Wizor's: from n/a through <= 2.12.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes VegaDays vegadays allows PHP Local File Inclusion.This issue affects VegaDays: from n/a through <= 1.2.0.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Unica unica allows PHP Local File Inclusion.This issue affects Unica: from n/a through <= 1.4.1.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Triompher triompher allows PHP Local File Inclusion.This issue affects Triompher: from n/a through <= 1.1.0.

Deserialization of Untrusted Data vulnerability in AncoraThemes Melody melodyschool allows Object Injection.This issue affects Melody: from n/a through <= 1.6.3.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Dentalux dentalux allows PHP Local File Inclusion.This issue affects Dentalux: from n/a through <= 3.3.

Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6.

Deserialization of Untrusted Data vulnerability in AncoraThemes Morning Records morning-records allows Object Injection.This issue affects Morning Records: from n/a through <= 1.2.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Mr. Cobbler mr-cobbler allows PHP Local File Inclusion.This issue affects Mr. Cobbler: from n/a through <= 1.1.9.