mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 04:29:23 -10:00
Update Mon Aug 10 12:02:20 UTC 2026
This commit is contained in:
trickest-workflows committed
1 parent
7696bc8f7f
commit
457ae328ac
164 files changed
+2727
-4
No files matched your search
@@ -10,6 +10,7 @@ Race condition in the Symantec Enterprise Security Manager (ESM) 6.5.3 managers
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://securityresponse.symantec.com/avcenter/security/Content/2007.05.24b.html
|
||||
- http://www.vupen.com/english/advisories/2007/1940
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -11,6 +11,7 @@ Array index error in libmpdemux/demux_mov.c in MPlayer 1.0 rc2 and earlier might
|
||||
|
||||
#### Reference
|
||||
- http://securityreason.com/securityalert/3607
|
||||
- http://www.coresecurity.com/?action=item&id=2102
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ Unspecified vulnerability in the Java Runtime Environment (JRE) component in Ora
|
||||
#### Reference
|
||||
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html
|
||||
- http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
|
||||
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19570
|
||||
|
||||
#### Github
|
||||
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2020-35833](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35833)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBK20 before 2.3.5.26, RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK40 before 2.3.5.30, RBR40 before 2.3.5.30, RBS40 before 2.3.5.30, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, XR500 before 2.3.2.56, and XR700 before 1.0.1.10.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://kb.netgear.com/000062677/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-WiFi-Systems-PSV-2018-0512
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2022-4995](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4995)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary secId and plandetailid field values. Successful exploitation results in remote code execution under the privileges of the application server process. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14 (UTC).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.vulncheck.com/advisories/weaver-e-cology-file-upload-rce-via-uploaderoperate-jsp
|
||||
- https://www.weaver.com.cn/cs/ecology_full_log_en.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -17,6 +17,7 @@ A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an u
|
||||
|
||||
#### Reference
|
||||
- https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r
|
||||
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md
|
||||
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-15623](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15623)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.Unauthenticated user can retrieve database password in plaintext in certain situations
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sparxsystems.com/products/procloudserver/6.1/history.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-15624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15624)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sparxsystems.com/products/procloudserver/6.1/history.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-15625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15625)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sparxsystems.com/products/procloudserver/6.1/history.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-15667](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15667)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of the component MP4Box. This manipulation of the argument nalu_out_bs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/gpac/gpac/issues/3403
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-4375](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4375)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. This issue affects Pro Cloud Server: earlier than 6.0.165.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sparxsystems.com/products/procloudserver/6.1/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-4376](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4376)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). This issue affects Pro Cloud Server: earlier than 6.0.165.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sparxsystems.com/products/procloudserver/6.1/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-4377](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4377)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pro Cloud Server: earlier than 6.0.165.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sparxsystems.com/products/procloudserver/6.1/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-50455](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50455)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/advisory.md
|
||||
- https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/poc.py
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-53000](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53000)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.imperva.com/blog/code-execution-in-jupyter-notebook-exports
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within
|
||||
|
||||
#### Reference
|
||||
- https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss
|
||||
- https://www.youtube.com/watch?v=mN-0Zia1LZw
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -19,7 +19,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-65336](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65336)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/ecommercefruitsbazarmaster/20250811-ecommerce-project-with-php-and-mysqli-fruits-bazar-show_price_by_pdtid.php-pid-sqli/20250811-ecommerce-project-with-php-and-mysqli-fruits-bazar-show_price_by_pdtid.php-pid-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-65337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65337)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/fantasticblog/XSS1.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-65340](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65340)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-betweendates-detailsreports.php-fromdate-sqli/20250811-hospital-management-system-betweendates-detailsreports.php-fromdate-sqli.md#injection-techniques-as-identified-by-sqlmap
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-65341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65341)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/ecommercefruitsbazar/XSS.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-65342](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65342)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/bloodsystem/XSS1.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-67403](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67403)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_class.php-class_name-sqli/20250811-casap-automated-enrollment-system-update_class.php-class_name-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-67404](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67404)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_stud.php-fname-sqli/20250811-casap-automated-enrollment-system-save_stud.php-fname-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-67405](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67405)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_password.php-new_password-sqli/20250811-casap-automated-enrollment-system-update_password.php-new_password-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-67406](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67406)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: control/activate_case.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activate_case.php in parameter id endpoint of Advocate office management system. Unsanitized user input in the specified parameter is interpolated directly into an SQL query, allowing attackers to infer or extract data and, in some cases, execute stacked/time-based payloads. ¶¶ Affected Component & Parameter Affected Endpoint URL: http://localhost/advocate/kortex_lite/control/activate_case.php?id=1 HTTP Method: GET Vulnerable File: activate_case.php Parameter: id Vector Location: GET Injection Techniques (as identified by sqlmap) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: id=1 AND EXTRACTVALUE(6268,CONCAT(0x5c,0x71766b6a71,(SELECT (ELT(6268=6268,1))),0x716a7a6b71)) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 4464 FROM (SELECT(SLEEP(5)))aHqo) Proof of Concept (Burp Repeater)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/advocate/20250811-advocate-office-management-system-activate_case.php-id-sqli/20250811-advocate-office-management-system-activate_case.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-67407](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67407)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_student.php-fname-sqli/20250811-casap-automated-enrollment-system-update_student.php-fname-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-67408](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67408)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_user.php-status-sqli/20250811-casap-automated-enrollment-system-save_user.php-status-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-69205](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69205)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the `Dial( )` application due to improper input validation. This allows an attacker to redirect calls on both of the federating instances. If the attack succeeds, the impact is very high. However, the requires that an admin accept the federation requests. As of time of publication, a known patched version of µURU is not available.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/olell/uURU/security/advisories/GHSA-xvrh-pm3f-79v4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69286)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/infiniflow/ragflow/security/advisories/GHSA-9j5g-g4xm-57w7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69437](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69437)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be triggered, resulting in issues such as credential theft, arbitrary API execution, and other security concerns. This vulnerability affects all file upload endpoint, including /cmsTemplate/save, /file/doUpload, /cmsTemplate/doUpload, /file/doBatchUpload, /cmsWebFile/doUpload, etc.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sanluan/PublicCMS/issues/103
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69770)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kid-tnt/Mojo-check/blob/main/Zipslip%20in%20MojoPortal%20version%202.9.0.1.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69820](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69820)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ryotaromatsui/CVEs/tree/main/CVE-2025-69820
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69871](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69871)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage limits by sending concurrent checkout requests, resulting in unlimited redemptions of limited-use promotional codes and potential financial loss.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69871-MedusaJS-TOCTOU.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69874](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69874)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69874-nanotar-Path-Traversal.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69930](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69930)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-print_membership_card.php-id-sqli/20250811-membership-management-system-print_membership_card.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69931](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69931)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-delete_membership.php-id-sqli/20250811-membership-management-system-delete_membership.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69933](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69933)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-memberprofile.php-id-sqli/20250811-membership-management-system-memberprofile.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69934)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-delete_members.php-id-sqli/20250811-membership-management-system-delete_members.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69935](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69935)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-revenue_report.php-fromdate-sqli/20250811-membership-management-system-revenue_report.php-fromdate-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69936](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69936)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-edit_member.php-id-sqli/20250811-membership-management-system-edit_member.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69937](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69937)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-edit_type.php-id-sqli/20250811-membership-management-system-edit_type.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69938](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69938)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-renew.php-membershiptype-sqli/20250811-membership-management-system-renew.php-membershiptype-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69941](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69941)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/tailor/20250811-tailor-ms-addmeasurement.php-id-sqli/20250811-tailor-ms-addmeasurement.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69942)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-view-patient.php-viewid-sqli/20250811-hospital-management-system-view-patient.php-viewid-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-69943](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69943)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-doctor-sqli/20250811-hospital-management-system-get_doctor.php-doctor-sqli.md
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69944](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69944)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-view-medhistory.php-viewid-sqli/20250811-hospital-management-system-view-medhistory.php-viewid-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69945)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-edit-patient.php-editid-sqli/20250811-hospital-management-system-edit-patient.php-editid-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2025-69946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69946)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli.md
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli.md
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli.md
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli.md
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-delete_group.php-id-sqli/20250811-modern-loan-management-system-delete_group.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69947](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69947)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/tailor/20250811-tailor-ms-customeredit.php-id-sqli/20250811-tailor-ms-customeredit.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-69948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69948)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-emailid-sqli/20250811-hospital-management-system-check_availability.php-emailid-sqli.md
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-delete_group.php-id-sqli/20250811-modern-loan-management-system-delete_group.php-id-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-69949](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69949)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-email-sqli/20250811-hospital-management-system-check_availability.php-email-sqli.md
|
||||
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-emailid-sqli/20250811-hospital-management-system-check_availability.php-emailid-sqli.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-69985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69985)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/lihy10/8cb2dd65ebf1385f12a7e00e25a50d40
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -25,7 +25,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -15,6 +15,7 @@ Es wurde eine problematische Schwachstelle in atjiu pybbs bis 6.0.0 gefunden. Es
|
||||
- https://github.com/atjiu/pybbs/issues/199
|
||||
- https://github.com/atjiu/pybbs/issues/199#issue-3256276118
|
||||
- https://github.com/atjiu/pybbs/issues/199#issuecomment-3134573731
|
||||
- https://vuldb.com/?ctiid.318675
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-12971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12971)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ef69bd9d-ec2a-4526-b2b9-51948fa76980/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13170](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13170)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c7bdaa80-a446-4c72-be79-bfc5022a4eca/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13600](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13600)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/2f69e28f-cc9f-422e-a014-662f3fddfad3/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13701](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13701)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/2710686c-055c-460c-8480-573e394f24d8/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14206)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/36ae857c-6812-46e0-a0e7-6c868108ef39/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14211](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14211)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/511d2d53-34c5-4457-bc25-6f9105b57825/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.
|
||||
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-14237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14237)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/7f1eb6ec-c4fb-4c0d-887d-1812a84e29c0/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14238](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14238)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d526b352-74a4-444c-a251-75468863b444/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14293)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/99fa208c-1a6f-4379-847c-388b9cec349e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14860](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14860)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ea752266-9bff-4c36-91aa-9aca0232c7af/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14941](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14941)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/572ba4a2-1b51-4631-9c28-7cc3d44f0761/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15047](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15047)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/79e830c3-232b-4eff-8cf1-d25c5310984c/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15229](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15229)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/be12c266-dee7-463d-ae71-9f7b7e0258ee/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15237)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b312a323-808c-497f-b67e-3b0acfcb8932/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15238](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15238)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/7283a28a-7241-4b9e-8fc5-5b427191c80e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16257)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/89c32854-1cf1-4fe9-a6d0-6244be2dcc03/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16298](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16298)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d554361c-e6c7-4843-a9cc-005b08685a5b/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16299)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/06532a5a-ad34-421e-81e3-b4e44e8023ab/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16949](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16949)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/3e07356a-5ac8-4d9f-bef2-65aaecbf1419/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16985)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/045a15f3-5750-4c4e-977d-e1283e3c967d/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17010](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17010)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/1e760dbf-7efc-4511-9a05-2d1476eb3dfb/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17012](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17012)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/01cc2578-8bf8-4889-9e21-7b78cae074d7/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17016](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17016)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/fb73461f-521a-401b-98d0-5f32272368b8/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17018](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17018)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/df87c8d0-b3f3-4995-ac95-d63544e71a32/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17019](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17019)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/355ea90d-9fb3-4dc6-9676-48e5255fbc77/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17020](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17020)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6e7852e9-0acd-4a79-9240-b864b14459a3/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17021](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17021)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/fbbfa907-3efd-4050-9651-d3836af062a9/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17022](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17022)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ddc84492-408b-477c-ac6c-b9ec96ccf223/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17023](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17023)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a116db0a-38ea-43e3-a9cd-991768ce3e07/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17540)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/096cb7df-26a5-4f5f-bbec-725e063a2b75/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17541)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/972bf72f-08c4-41ec-b6e9-2d6083d21734/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17542)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d17f3de9-b0f9-4bbd-8a57-18cda9d43d79/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18030](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18030)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account.Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/15463bda-fb39-4629-b96b-34b83191bab7/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18200](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18200)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a5864653-4df6-4d8d-9f8a-ace7b0220342/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18468](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18468)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0b567954-4bcc-4e2a-a2b5-024175012a19/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18469)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/be74144a-b45b-469f-8631-7fdca6d19a66/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18470](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18470)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/589b7661-4a0d-4041-8c29-2819d8b1e402/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18666](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18666)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/7a9b3fff-f454-4764-ad60-0b273781f7b4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18786](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18786)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f53e1706-e926-4a2c-a2a7-465b4ca5d102/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18934)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f87c5a11-59a1-47cc-bc1c-d12108b510ab/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18946)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/fa13ebbb-8eea-492d-8f59-58228efb94d8/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18960)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c80abded-9f0e-4e44-8c8a-b0d1bc1b16d0/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-19049](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19049)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/5405c86c-1cf5-4123-9dea-864096d07520/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-19053](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19053)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c9bad349-d2d6-4b67-a107-818f25d9bf76/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
Loaded 100 of 164 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user