CVE Vulnerability Catalog

In ChurchCRM prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist fails to block standard .php files, allowing direct code execution via HTTP after extraction in the web root.

A remote code execution vulnerability was identified in the ServiceNow AI platform, potentially allowing an unauthenticated user to execute code under certain circumstances. The issue has been addressed with security updates for hosted and self-hosted instances.

The vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 derives the session-cookie signing key from the non-cryptographic Math.random() generator and discloses its outputs to unauthenticated clients during login. A remote attacker can collect a few login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

A signed integer overflow vulnerability in Storable versions before 3.41 for Perl occurs when deserializing a crafted SX_HOOK record. The retrieve_hook_common function reads a signed 32-bit item count, and adding one to I32_MAX wraps it to a negative value.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. Overflow of a 16-bit field truncates the match decision table, leading to false positive and false negative matches.

A remote code execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. An unauthenticated attacker can upload arbitrary PHP files by providing a base64-encoded payload and execute arbitrary code on the server. The issue has been fixed in a patch released in April 2026.

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint. Attackers can execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Lack of input sanitization leads to direct command execution via passthru() with root privileges.

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint. The flaw is a double-evaluation issue: escapeshellarg() is applied to the host parameter, but the system wrapper retrieves the decoded value from argv and passes it to a second shell_exec() call without sanitization.

An integer overflow vulnerability has been found in the do_sub() routine in the "builtin.c" file of gawk. It affects 32-bit builds of gawk versions 5.4.0 and below, potentially allowing heap metadata overwrite and program crash.

An integer overflow vulnerability has been found in the "builtin.c" file of gawk versions 5.4.0 and below. This issue may lead to memory exhaustion on the hosting operating system and could allow an attacker to overwrite gawk heap metadata and objects with controlled bytes.

Mura CMS versions prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitized before being processed by the ColdFusion engine. A remote attacker can exploit this to inject and execute arbitrary CFML expressions and instantiate malicious Java objects, compromising system security.

A missing authorization vulnerability in the repository creation functionality of Google Cloud BigQuery, Dataform, and Colab Enterprise allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. The vulnerability affects versions between October 2025 and May 10, 2026.

The Directorist plugin for WordPress contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 8.8.2.

The AIWU content generator plugin contains a blind SQL injection vulnerability in versions up to and including 1.5.4. An attacker can exploit improper neutralization of special elements in SQL commands.

The MailOptin WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.2.77.3 inclusive.

The Realtyna Organic IDX plugin (real-estate-listing-realtyna-wpl) for WordPress contains a code injection vulnerability that allows remote code inclusion. The issue affects versions up to and including 5.2.0.

The Grand Photography WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 5.7.8.

The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can remotely exploit this flaw to execute arbitrary code or manipulate data.

The AcyMailing SMTP Newsletter plugin for WordPress contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions up to and including 10.11.0.

The 777 triple-seven WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 1.13.0.