CVE-2026-92978 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

EUVD-2026-103227

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

CVE-2026-92978 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

CVE-2026-92978

The User Registration & Membership plugin for WordPress (versions up to and including 5.2.8 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is missing or incorrect nonce validation on the trigger_bulk_action() function. Specifically, an attacker can bypass nonce chec...

Node.js-CVE-2017-5941

NodeJS Insecure Deserialisation Vulnerability Demo Node.js is an open-source runtime environment used to implement server functionality in JavaScript. A specific software package within Node.js contains a vulnerable function dealing with deserialisation, that causes it to run unauthorised command...

CVE-2026-18110-PoC

CVE-2026-18110 — Concrete CMS Unauthenticated User Enumeration Summary Concrete CMS 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. Thi...

PT-2026-116472

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta Description An authorization bypass exists in the isFaqAccessibleForUser function, which incorrectly treats missing FAQ translations as visible to unauthenticated users. By sending a mismatched...

CVE-2026-92978: Cross-Site Request Forgery (CSRF)

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

PT-2026-116362

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.1.1 Description The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference IDOR flaw. This occurs because the Input::sanitize array function fails to strip attacker-supplied POST keys, allowin...

PT-2026-116364

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9 Description This issue involves Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to. Unauthenticated attackers can force...

PT-2026-116499

Name of the Vulnerable Software and Affected Versions Coder versions 2.0.0 through 2.34.7 Description An open redirect issue exists in the handleAPIKeySmuggling function. Attackers can redirect users to external sites by using unsanitized r.URL.Path values. By crafting links on trusted workspace...

PPLmedic

PPLmedic This tool implements a Userland exploit chain for injecting arbitrary code into a PPL with the signer type Windows and elevating to the signer type WinTcb. These techniques were originally discussed by James Forshaw a.k.a. @tiraniddo in his blog post Injecting Code into Windows Protected...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-93749 DESCRIPTION:...

CVE-2026-104110

Unauthenticated information disclosure in FileRise Pro portal endpoint get.php Summary public/api/pro/portals/get.php returns the full internal record of a FileRise Pro client portal — including its internal storage folder path, the client's contact email, and its complete upload policy — to any...

TCM-Security-Practical-Network-Penetration-Tester

Escalation Paths 1. Kernel Exploits 2. S...

go-vikunja Vikunja Authorization Issue Vulnerability

The go-vikunja Vikunja versions from 1.0.0-rc0 to 2.7.0 had an authorization issue. This vulnerability stemmed from improper authorization in the RecalculateTaskPositions function, allowing authenticated users with access to the project to write to the taskpositions row for all tasks. An attacker...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne reported an authorization issue in versions of phpMyFAQ from 3.2.0 to 4.0.0, and from 4.0.2 to 4.2.0-beta. The issue stems from a bypass in the Microsoft Entra ID login process. By associating users through a variable preferredusername, and because the function AuthEntraId::create...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne’s phpMyFAQ version 4.2.0-alpha to 4.2.0-beta had an authorization issue. This vulnerability stemmed from a bypass in the isFaqAccessibleForUser function, allowing unauthorized users to access FAQ translations that were not protected by ACL restrictions. Attackers could exploit this...

WordPress User Registration & Membership Cross-Site Request Forgery Vulnerability

WordPress User Registration & Membership versions 5.2.8 and earlier have a cross-site request forgeing vulnerability. This vulnerability stems from a lack of proper nonce validation in the triggerbulkaction function. Attackers can bypass the nonce check in triggerqueryactions by providing an empt...

Security Bulletin: IBM Cognos Analytics is affected by security vulnerabilities across multiple versions of the product

Summary There are vulnerabilities in multiple Open Source Software OSS components consumed by IBM Cognos Analytics in all supported application versions. This Security Bulletin addresses the affected versions and the remediation versions which contain the fixes. Please note that certain CVEs are...