Threat database

CVE-2026-62022 is a critical vulnerability in Select-Themes Tonda Membership version 1.0.1 and earlier that allows unauthenticated users to escalate privileges due to incorrect privilege assignment. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-28152 is a high-severity vulnerability in Select-Themes Tonda Core versions prior to 2.6. It involves an unauthenticated local file inclusion flaw, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to potentially include arbitrary files on the server, leading to high impact on confidentiality, integrity, and availability.

CVE-2026-28151 is a high-severity vulnerability in Select-Themes Tonda versions prior to 2.6. It involves an unauthenticated local file inclusion flaw that allows improper control of filenames used in include or require statements in PHP. This vulnerability is categorized under CWE-98 and can lead to full confidentiality, integrity, and availability impact if exploited.

Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 2.1.

CVE-2026-40752 is a high severity vulnerability affecting Select-Themes Manufaktur Solutions versions up to and including 1.1.1. It involves unauthenticated PHP object injection, categorized under CWE-502 (Deserialization of Untrusted Data). This vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service without any authentication. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-39560 is a high-severity vulnerability in Select-Themes Hiroshi versions up to and including 1.5.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service without requiring authentication.

CVE-2026-39573 is a high-severity vulnerability in Select-Themes Mildhill versions up to and including 1.5. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code or cause denial of service without requiring authentication. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-39545 is a high-severity vulnerability in Select-Themes Zermatt versions up to and including 1.6.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service without requiring authentication.

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.

Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Moments moments allows PHP Local File Inclusion.This issue affects Moments: from n/a through <= 2.2.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Mixtape mixtape allows PHP Local File Inclusion.This issue affects Mixtape: from n/a through <= 2.1.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Don Peppe donpeppe allows PHP Local File Inclusion.This issue affects Don Peppe: from n/a through <= 1.3.