By Month

Oct 2026
Sept 2026
Aug 2026
Jul 2026
Dec 2025
Apr 2024
Mar 2024
Older Announcements...
View RSS Feed

  By Month

  Support

My Support Tickets
Announcements
Knowledgebase
Downloads
Network Status
Open Ticket

Announcements

CVE-2025-40690 (matched: php)

  • 1st October 2026

SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.

Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-40690

Continue reading

CVE-2026-75957 (matched: wordpress)

  • 1st October 2026
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler ...
Continue reading

CVE-2026-15989 (matched: wordpress)

  • 1st October 2026
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to ...
Continue reading

CVE-2026-92966 (matched: wordpress)

  • 1st October 2026
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it ...
Continue reading

  Support

My Support Tickets
Announcements
Knowledgebase
Downloads
Network Status
Open Ticket