WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability

Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...

CVE-2023-48084-Revised

CVE-2023-48084 — updated PoC Repository: MettHK/CVE-2023-48084-Revised Updated version of Hamibubu/CVE-2023-48084 with multithreading, binary-search extraction, and CLI flags for database / table / column selection. Not the original repository. This is a derivative/improved PoC. Credit for the...

CVE-2026-104454

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454

YesWiki versions before 4.6.7 are vulnerable to an algorithmic-complexity denial of service within the wakka.php formatter. The root cause is an O(n^2) markdown-link regular expression that allows unauthenticated attackers to submit a small, specially crafted body of bracket characters to the pag...

EUVD-2026-91465

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin, versions 2.0.0 through 2.0.6 , contains a vulnerability where it fails to enforce site-wide access restrictions on the WordPress REST API . This flaw allows unauthenticated users to read the content of published posts and pages that were specifical...

CVE-2026-90952 WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

WordPress WP Edit Password Protected plugin 2.0.0-2.0.6 - Unauthenticated Site-Wide Access Mode Bypass vulnerability

Unauthenticated Site-Wide Access Mode Bypass vulnerability discovered by Artus KG in WordPress Plugin Wp Edit Password Protected – Create Member/User Only Page & Design Password Protected Form versions 2.0.0-2.0.6...

EUVD-2026-91212

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

PT-2026-104111

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

zencart_auth_rce_poc

zencartauthrcepoc CVE-2021-3291 1- login as admin 2- get any modules edit page 3- inspect element any true radiobox 4- change true to true','MODULEORDERTOTALTOTALSTATUS'; echo id; // 5- click update 6- to trig command go again edit page CVE-2021-3291 https://vulners.com/cve/CVE-2021-3291 POC...

CVE-2024-57487-and-CVE-2024-57488

Online Car Rental System Vulnerabilities This repository contains details about the vulnerabilities identified in Code-Projects Online Car Rental System project Version 1.0. The vulnerabilities have been assigned CVEs and include comprehensive writeups to assist in understanding and mitigating th...

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

SummaryAny member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...

CVE-2026-30082

Stored Cross-site Scripting XSS vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server Affected version: IngEstate Server - 11.14.0 Affected Function Affected API: Affected API: PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1 PoC To exploit this Stored...

CVE-2025-46204

Description Unifiedtransform v2.0 is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify course details via the /course/edit/id endpoints. This functionality intended exclusively for administrative use. Exploiting this flaw allows unauthorized manipulation...

CVE-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...