CVE-2026-100903

The GEOritm software by ООО НПО Ритм (versions up to 2.45.1 ) contains a missing authentication vulnerability within the REST API component. Specifically, manipulating the objectId argument in the /restapi/objects/obj-groups file allows for unauthorized remote access. The vendor has confirmed the...

CVE-2026-100903 ООО НПО Ритм GEOritm REST API obj-groups missing authentication

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

PT-2026-99776

Name of the Vulnerable Software and Affected Versions WP Verify API WordPress plugin version 1.0.0 Description An authorization check is missing in a REST route, which allows unauthenticated users to insert arbitrary data into the plugin database table. Additionally, this flaw enables the site to...

CVE-2026-100903: Missing Authentication for Critical Function

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

Exploit for Interpretation Conflict in Wordpress

WP2Shell — Unauthenticated SQL Injection Proof of Concept C...

POC-ELEMENTOR-CSRF

POC-ELEMENTOR-CSRF — Laboratorio pedagógico del bypass del non...

CVE-2026-96899

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96899

The Optima Express IDX WordPress plugin (versions 8.6.0 - 8.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly neutralise a script value submitted via a REST endpoint before storing it and subsequently echoing it into the document head ...

CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

EUVD-2026-87901

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2017-5487-EXPLOIT

CVE-2017-5487 - Énumération d'utilisateurs WordPress Une vulnérabilité a été découverte dans l'implémentation de l'API REST de WordPress 4.7 avant 4.7.1. Cette vulnérabilité est présente dans le fichier class-wp-rest-users-controller.php situé dans wp-includes/rest-api/endpoints. Le défaut provie...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

CVE-2026-96899: Improper Neutralization of Input During Web Page Generation

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

PT-2026-99506

Name of the Vulnerable Software and Affected Versions Optima Express IDX WordPress plugin versions prior to 8.7.6 Description Stored Cross-Site Scripting occurs because the plugin fails to properly neutralize script values submitted through a REST endpoint. These values are stored and subsequentl...

VulnCheck KEV: CVE-2024-5522

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

Exploit for Interpretation Conflict in Wordpress

LANGZ — wp2shell Exploit Tool Author: LANGZ CVE: CV...

CVE-2026-100631

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...