Research & Vulnerability Disclosures | incogbyte

2026

Access control and authentication

SQL injection

CVE-2026-4189phpIPAMSecond-order SQL injection Medium 4.7

2024

Access control

CVE-2024-33329LumisXPHardcoded privileged identifier and authorization bypass High 7.5

Code execution

CVE-2024-48463Bruno IDERemote code execution Medium 6.5

Cross-site scripting

2023

SQL injection

CVE-2023-26876PiwigoSQL injection with a public Metasploit module High 8.8

File upload and code execution

CVE-2023-26877SoftExpert Excellence SuiteUnrestricted file upload and code execution Medium 6.3

2022

Path traversal

CVE-2022-2863WPvivid BackupAuthenticated path traversal Medium 4.9

2021

Cross-site scripting and CSRF

2020

File upload and code execution

CVE-2020-25790Typesetter CMSDangerous file upload leading to code execution High 7.2

Cross-site scripting

CVE-2020-35581Envira GalleryStored cross-site scripting Medium 5.4

2019

Cross-site scripting and CSRF

Additional public research is available on Packet Storm and Exploit Database.