CVE-2024-7593

Detección de CVE-2024-7593 ¿Cómo funciona este método de detección? Esta plantilla coincide con las siguientes versiones; si hay coincidencia, se considera que el host es vulnerable: - "22.2" - "22.3" - "22.3R2" - "22.5R1" - "22.6R1" - "22.7R1" Para evitar generar falsos positivos FPs, también...

CVE-2026-92536

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

CVE-2026-92551 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppressbillingaddress Filename Parameter in all versions up to, and including, 4.17.4 due to insufficie...

CVE-2026-97344: Improper Neutralization of Input During Web Page Generation

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

PT-2026-104514

Name of the Vulnerable Software and Affected Versions Wp Social Login and Register Social Counter versions prior to 3.2.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. An...

PT-2026-104590

Name of the Vulnerable Software and Affected Versions vincent-peugnet/wcms versions prior to 3.18.1 Description A stored cross-site scripting issue allows unauthenticated attackers to inject scripts through the login user field and the visitor comment website field. Scripts can be executed with...

PT-2026-104483

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

Exploit for CVE-2026-15989

CVE-2026-15989 — Super Forms ≤ 6.3.316 — Unauthenticated Privi...

WordPress Wp Social Login and Register Social Counter plugin <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin Wp Social versions = 3.2.1...

CVE-2026-1199

A flaw was found in Zabbix. The API and Frontend login lockout mechanism does not properly count several unsuccessful login requests if they are sent simultaneously. This oversight allows a remote attacker to bypass the intended lockout counter, potentially enabling more password guesses than...

CVE-2026-13413 CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, ...

CVE-2026-13413 CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, ...

CVE-2026-15897

The Super Forms – Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316 ) is vulnerable to Privilege Escalation . The flaw exists in the Register & Login add-on's before_email_success_msg() function, which fails to perform ownership or capability checks when proc...

EUVD-2026-91176

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

Apache Axis2 Default Login

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. id: CVE-2010-02...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution RCE flaw CVE-2025-47812. The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected sessio...

CVE-2026-15897: Improper Privilege Management

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

PT-2026-104078

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 Description An issue exists in the Register & Login add-on where the before email success msg function, during the register login action='update' flow, trusts a user-supplied use...

The vulnerability of the final point /login/oauth/userinfo of the Git repository management system Gitea, which allows a hacker to compromise the confidentiality and integrity of the protected information

The vulnerability of the final point /login/oauth/userinfo of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...