CVE-2026-39749

The WordPress App for Cloudflare® plugin versions

CVE-2026-32570 WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

CVE-2026-32570 WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

CVE-2026-32570

The Progressify - Progressive Web App (PWA) plugin for WordPress is affected by an unauthenticated Cross-Site Scripting (XSS) vulnerability in versions

EUVD-2026-93233

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...

Web-App-PenTesting

🚀 Quick Start 1. Clone the repository git clone https://github.com/Sarthak4126/Web-App-PenTesting.git cd Web-App-PenTesting/targetapp 2. Install dependencies pip install -r requirements.txt 3. Launch the target application python app.py App runs at: http://127.0.0.1:5000 4. Run the automated...

PT-2026-106823

Name of the Vulnerable Software and Affected Versions @quasar/ssl-certificate versions prior to 2.1.0 @quasar/cli versions prior to 5.0.4 @quasar/app-vite versions prior to 3.3.0 Description The @quasar/ssl-certificate utility caches a combined private key and certificate PEM without applying...

PT-2026-106423

Subscriber Broken Access Control in App for Cloudflare® = 1.10.1 versions...

PT-2026-106398

Name of the Vulnerable Software and Affected Versions Progressify - Progressive Web App PWA versions prior to 1.6.1 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior...

PT-2026-106708

Name of the Vulnerable Software and Affected Versions Craft CMS version 5.10.13.2 Description An authenticated remote code execution issue exists in the Control Panel action 'app/render-components'. Users with basic Control Panel access can submit request-controlled component classes and property...

PT-2026-106825

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 3.3.0 Description Several @quasar/app-vite Server-Side Rendering SSR and Static Site Generation SSG rendering paths interpolate the ssrContext.nonce variable directly into quoted HTML attributes. If an...

PT-2026-106826

Name of the Vulnerable Software and Affected Versions Quasar Framework versions 1.0.0 through 3.2.9 Description The @quasar/app-vite component recursively removes the resolved build.distDir before the build process begins. It fails to reject the project root, user home directory, filesystem roots...

PT-2026-106927

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

EUVD-2026-91055

Filament: Multi-factor authentication app management actions do not require password reauthentication...

GHSA-7M6H-RG42-M449 Filament: Multi-factor authentication (app) management actions do not require password reauthentication

App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regeneratin...

CVE-2021-41647

CVE-2021-41647 CVE-2021-41647 SQL Injection in Online-Food-Ordering-Web-App The Online-Food-Ordering-Web-App is vulnerable to un-authenticated error and time-based blind SQL Injection attacks. The username parameter on the /login.php page does not sanitize the user input, an attacker is able to...

CVE-2025-55182-Exploit-extension

RSC Fingerprint Detector A Chrome extension for detecting React Server Components RSC and Next.js App Router fingerprints on web pages. ⚠️ Important Notice This extension is intended for educational and security research purposes only. It includes functionality that may be used to test for...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-104871 via @angular/ssr (>=21.1.2, <=21.2.7)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.0.2, =0.0.3 Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

EUVD-2026-92530

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...