今日共收录 1483 条安全情报，包含 647 个 CVE，430 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-15734
A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated att
CVE-2026-15733
A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injectio
CVE-2026-15732
A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functiona
CVE-2026-15256
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate
CVE-2026-15208
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, p
CVE-2026-15152
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment
CVE-2026-15149
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total ar
CVE-2026-15147
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming paymen
CVE-2026-14936
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the s
CVE-2026-14842
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record b
CVE-2026-14831
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking durat
CVE-2026-14306
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected co
CVE-2026-14225
The Easy Appointments WordPress plugin through 3.12.26 does not correctly validate shortcode input in one of its block-r
CVE-2026-13399
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a
CVE-2026-13342
The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-base
CVE-2026-12901
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications,
CVE-2026-12501
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent
CVE-2026-11803
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A mal
CVE-2026-11361
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payme
CVE-2026-10599
The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transact